CVE-2026-53581: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in opnsense core

CVE-2026-53581 is a critical path traversal vulnerability in OPNsense core's NTP configuration module. It allows an attacker with access to the NTP configuration and elevated privileges to escape the intended directory restrictions by manipulating GPS or PPS serial port parameters. This enables overwriting arbitrary files on the filesystem with root privileges. The issue affects versions prior to 26.1.9 of opnsense/core and prior to 26.4_20 of BE/opnsense/core. The vulnerability has been patched in these versions.

Successful exploitation allows an attacker with access to the NTP configuration and high privileges to overwrite arbitrary files on the system as root. This can lead to complete system compromise, including code execution and denial of service. The CVSS score of 9.0 reflects the critical nature of this vulnerability with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Upgrade to opnsense/core version 26.1.9 or later, or BE/opnsense/core version 26.4_20 or later to apply the official fix. These versions patch the path traversal vulnerability in the NTP configuration module. No other mitigation is indicated or required once patched.