The luci-app-openvpn component of OpenWrt fails to properly validate the instance_name2 parameter during file upload operations. This improper validation allows authenticated users to perform path traversal attacks, enabling them to write files outside the designated upload directory. By leveraging this vulnerability, attackers can upload malicious payloads such as SSH keys into system directories, which can be used to gain persistent root-level code execution after a system reboot.

Successful exploitation allows an authenticated attacker to write arbitrary files to sensitive system locations, potentially leading to persistent root code execution. This compromises the integrity and security of the affected device, allowing full control by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the luci-app-openvpn interface to trusted users only and monitor for suspicious activity related to file uploads.