CVE-2026-57155: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in opnsense core
Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
CVSS v3.1
Score 9.9critical
Affected software
opnsense
core
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OPNsense core versions before 26.1.11 contain a path traversal vulnerability in the Firewall Alias GeoIP importer's process_zip() and process_gzip() functions located in src/opnsense/scripts/filter/lib/alias/geoip.py. These functions use an unvalidated CSV country_code value to build output filenames under /usr/local/share/GeoIP/alias. An attacker with Firewall Alias Edit privileges can supply a malicious GeoIP source URL containing an archive with a crafted country code that traverses directories, allowing arbitrary files to be written as root with an -IPv4 or -IPv6 suffix. By combining this with a crafted newsyslog fragment and an oversized log file, the default hourly root cron job can be leveraged to execute commands as root, resulting in complete compromise of the firewall. The vulnerability is addressed in OPNsense version 26.1.11.
Potential Impact
Successful exploitation allows an attacker with Firewall Alias Edit privileges to write arbitrary files as root on the firewall system. This can lead to execution of arbitrary commands with root privileges via the default root cron job, resulting in full system compromise. The vulnerability affects confidentiality, integrity, and availability of the firewall.
Mitigation Recommendations
This vulnerability is fixed in OPNsense version 26.1.11. Users should upgrade to version 26.1.11 or later to remediate this issue. No other mitigation or workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-24T01:45:48.698Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad0f2722cdf04f656409529
Added to database: 10/15/2026, 15:34:10 UTC
Last enriched: 10/15/2026, 15:48:16 UTC
Last updated: 10/15/2026, 16:04:12 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.