CVE-2026-72842

The CVE-2026-72842 path traversal is being misframed as a sanitization failure. It is not. The real vulnerability is that LuCI's ACL system was never architecturally equipped to gate LXC backend operations in the first place — the `%2E` encoding merely exploits a check that was never the actual security boundary. LuCI's ACL governs what users see in the web interface: menu items, form fields, visible configuration panels. It was designed around UI rendering logic, not privilege separation. When developers added LXC container management routes to the backend, they exposed privileged operations that execute `lxc.hook.start-host` scripts with host-root privileges — a completely different trust contract than the web session layer can reason about. The ACL validates session identity for UI purposes; it was never designed to verify whether that identity should trigger host-side scripts running outside any session context. This is a paradigm mismatch, not a missing check. The authorization gap exists because the web framework's mental model never extended to bridging session identity into the LXC backend's privilege domain. The path traversal via `/.%2E` bypasses routing-layer expectations about container name format, but what it actually reaches is code that assumes any authenticated session is authorized to trigger root-level hook scripts — an assumption that was never validated because the ACL system's scope was never re-examined when LXC was integrated. For defenders on OpenWrt, the implications extend beyond the router itself. Root on an OpenWrt device is root on the DHCP server, DNS forwarder, NAT gateway, and often the sole VPN terminus for the network behind it. Compromising this device means compromising everything connected to it — DNS poisoning, cookie harvesting, persistent MITM positioning are all achievable. The blast radius of this vulnerability is not the router's filesystem; it is every device on the broadcast domain. The patch should add explicit authorization checks that verify session privilege scope before invoking LXC backend operations — not just ACL checks that determine menu visibility. Until then, treat any LuCI user account as having potential access to host-root execution, regardless of role definition. The scope mismatch between web-session authorization and system-level script execution is the actual vulnerability; the path traversal is merely the access vector that makes it reachable.

Reviewed through automated stages and approved by a human before publication.