CVE-2026-58392: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in opnsense core

OPNsense core versions before 26.1.11 contain a stored cross-site scripting vulnerability in the NTP GPS page (src/www/services_ntpd_gps.php). The vulnerability arises because the initcmd value supplied by a user with page-services-ntp-gps privilege is base64 encoded and escaped, but then base64 decoded after escaping, resulting in unescaped HTML output. This allows an attacker to inject script code that executes in the session of any user who later opens the GPS page, potentially reading CSRF tokens and performing authenticated actions with the victim's privileges. The vulnerability is addressed in version 26.1.11.

An attacker with the page-services-ntp-gps privilege can inject malicious scripts that execute in the context of other users viewing the NTP GPS page. This can lead to theft of CSRF tokens and execution of authenticated actions, including those available to administrators. The CVSS 3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, and user interaction.

This vulnerability is fixed in OPNsense core version 26.1.11. Users should upgrade to version 26.1.11 or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.