luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via "/.%2E" in the "lxc_name" parameter to escape container directories and control host-side scripts executed through "lxc.hook.start-host", achieving root code execution on the OpenWrt host.