CVE-2026-58395: CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection') in opnsense core

OPNsense core versions before 26.1.11 contain an XPath Injection vulnerability (CWE-643) in the safe-delete path accessed via ApiMutableModelControllerBase::delBase(). An unvalidated safe-delete token from the request URL is interpolated into an XPath expression over config.xml before validation, allowing a user with any one affected module privilege to craft tokens that cause the XPath to match configuration data across 21 affected delete endpoints. These endpoints cover modules such as Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, and Kea DHCP. The vulnerability results in error responses that expose configuration item names, descriptions, reference paths, and UUIDs, effectively providing an XPath substring-presence oracle, including for modules the user cannot otherwise access. No configuration changes or deletions occur. The vulnerability is resolved in version 26.1.11.

An attacker with limited privileges in any one affected module can exploit this vulnerability to gain read-only access to sensitive configuration data across multiple modules, including those they do not have access to. This exposure includes configuration item names, descriptions, reference paths, and UUIDs. There is no impact on configuration integrity or availability, as no modifications or deletions are performed.

This vulnerability is fixed in OPNsense core version 26.1.11. Users should upgrade to version 26.1.11 or later to remediate this issue. No other mitigation is required as the fix addresses the root cause.