The luci-app-openvpn in OpenWrt fails to properly validate the instance_name2 parameter during file upload operations. This improper validation permits authenticated users to conduct path traversal attacks, allowing them to write files to arbitrary locations outside the designated upload directory. By leveraging this, attackers can upload malicious payloads such as SSH keys into system directories, which can be used to gain persistent root-level code execution on the device after reboot.

Successful exploitation allows an authenticated attacker to write arbitrary files outside the intended directory, potentially leading to persistent root code execution. This can compromise the entire device, allowing full control by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious file upload activity related to luci-app-openvpn.