A critical vulnerability (CVE-2026-72841) has been identified in the luci-app-openvpn plugin, affecting OpenWRT operating systems and Luci platforms. The vulnerability stems from improper validation of the instance_name2 parameter during file uploads, enabling authenticated attackers to perform path traversal and write arbitrary files outside intended directories. This allows for the placement of malicious payloads, such as SSH keys, in system directories that persist across reboots, leading to remote code execution with root privileges. The CVSS score of 9.9 reflects the high severity of this issue. All users of affected versions of luci-app-openvpn, OpenWRT, and Luci platforms are advised to apply the latest security patches immediately. Failure to do so may result in complete system compromise. Organizations should conduct inventory checks to identify affected systems and implement mitigation measures until patches are applied. This vulnerability underscores the importance of timely patch management for network infrastructure components.