CVE-2026-58393: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in opnsense core

OPNsense core before version 26.1.11 contains a path traversal vulnerability in the OpenVPN Client Specific Override feature. The common_name field accepts path traversal sequences that are concatenated into file paths without normalization or basename checks, specifically in the openvpn_csc_conf_write() function. Authenticated users with Client Specific Override privileges can store traversal sequences that cause generated OpenVPN configuration files to be written outside the intended /var/etc/openvpn-csc/<vpnid>/ directory. The vulnerability affects event handlers client_connect.php and user_pass_verify.php. Exploitation requires an attacker to cause a matching common name or username to be processed during OpenVPN client-connect or authentication events. The vulnerability is addressed in OPNsense version 26.1.11.

An authenticated user with Client Specific Override privileges can cause OpenVPN configuration files to be written outside the intended directory, potentially overwriting files or placing configuration files in unauthorized locations. The file content is generated OpenVPN configuration, not arbitrary data. The vulnerability does not impact confidentiality but can impact integrity and availability of the system. Exploitation requires specific conditions including triggering matching OpenVPN events. The CVSS 3.1 base score is 5.9 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

This vulnerability is fixed in OPNsense core version 26.1.11. Users should upgrade to version 26.1.11 or later to remediate this issue. No additional mitigations are indicated by the vendor advisory. Until upgrade, restrict Client Specific Override privileges to trusted users only.