Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
CVE-2026-63442 is a vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It involves improper output neutralization for logs, allowing unauthenticated attackers to inject carriage-return and line-feed characters into the WebGUI login username field. This injection manipulates syslog-ng log processing to forge authentication events, enabling attackers to block legitimate IP addresses by adding them to the sshlockout PF table or bypass password-guessing lockout mechanisms. The issue is fixed in version 26.1.11.
CVE-2026-58390 is a cross-site scripting (XSS) vulnerability in the OPNsense core firewall platform prior to version 26.1.11. It affects the OpenVPN connection-status dashboard widget and view, where a client common_name is inserted into HTML attributes without proper quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a username containing a double quote. An authenticated client can inject script that executes in an administrator's session when viewing the dashboard or connection-status page. The vulnerability allows reading config.xml, invoking privileged APIs, resetting the root password, and obtaining root command execution. This issue is fixed in version 26.1.11.
A cross-site scripting (XSS) vulnerability exists in OPNsense core prior to version 26.1.11. The vulnerability occurs because the certificate description field in the SSL Certificate selector does not properly escape HTML metacharacters, allowing a user with the page-system-certmanager privilege to inject markup. This markup executes when another user with access opens the System Settings Administration page. The issue is fixed in version 26.1.11.
CVE-2026-58392 is a cross-site scripting (XSS) vulnerability in the OPNsense core firewall and routing platform. The issue occurs on the NTP GPS page prior to version 26.1.11, where user-supplied input is improperly neutralized, allowing stored XSS. An attacker with page-services-ntp-gps privilege can inject malicious scripts that execute in the context of other users viewing the GPS page, potentially enabling theft of CSRF tokens and execution of authenticated actions. This vulnerability is fixed in version 26.1.11.
CVE-2026-58395 is an XPath Injection vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It allows a user with certain module privileges to send crafted tokens to delete endpoints, causing XPath expressions to expose configuration data across multiple modules without modifying the configuration. The issue is fixed in version 26.1.11.
A path traversal vulnerability (CWE-22) exists in OPNsense core prior to version 26.1.11. The OpenVPN Client Specific Override common_name field improperly accepts path traversal sequences, allowing an authenticated user with Client Specific Override privileges to cause OpenVPN configuration files to be written outside the intended directory. This occurs because the value is concatenated into a file path without normalization or basename checks. Exploitation requires triggering a matching OpenVPN client-connect or authentication event. The vulnerability is fixed in version 26.1.11.
CVE-2026-57155 is a critical path traversal vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It arises from improper validation of a CSV country_code value used in constructing output filenames during GeoIP alias imports. An attacker with Firewall Alias Edit privileges can exploit this to write arbitrary files as root, potentially leading to full firewall compromise via cron job execution. The issue is fixed in version 26.1.11.
A cross-site scripting (XSS) vulnerability exists in OPNsense core prior to version 26.1.11. The issue arises from improper encoding of stored category names and alias descriptions placed into HTML title attributes, allowing injection of script code. An authenticated user with Firewall Categories or Firewall Alias Edit privileges can exploit this by crafting malicious input that executes in the session of an administrator or other user viewing the affected Rules or NAT page. This can lead to unauthorized actions performed with the victim's privileges. The vulnerability is fixed in version 26.1.11.
CVE-2026-53582 is an XML Injection vulnerability in the OPNsense core Trust module prior to version 26.1.10. It allows users with CA Manager or Certificate Manager privileges to inject crafted refid values into XPath expressions, enabling them to recover sensitive configuration data character by character. Exposed data may include password hashes, API credentials, private keys, and VPN key material, potentially leading to privilege escalation and compromise of other security domains. The issue is fixed in OPNsense version 26.1.10.
A path traversal vulnerability (CWE-22) exists in the NTP configuration module of OPNsense core prior to version 26.1.9 and BE/opnsense/core prior to 26.4_20. This flaw allows an attacker with access to the NTP configuration and high privileges to overwrite arbitrary files on the system as root by manipulating GPS or PPS serial port parameters. The vulnerability is patched in versions 26.1.9 and 26.4_20 respectively.
CVE-2026-45158 is a critical vulnerability in OPNsense core versions prior to 26.1.8. It involves improper neutralization of argument delimiters in a command, specifically in the DHCP configuration processing. Unsanitized user input is passed to a shell script, enabling remote code execution as root on the underlying FreeBSD operating system. This vulnerability is fixed in version 26.1.8. The CVSS score is 9.1, indicating a high severity with network attack vector, low attack complexity, and full impact on confidentiality, integrity, and availability.
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.
A logic flaw in OPNsense core versions prior to 26.1.7 allows an unauthenticated attacker to bypass the authentication failure lockout mechanism. By submitting a crafted username containing success keywords between brute-force attempts, the attacker can reset the failure counter for their IP address, preventing lockout. This vulnerability is identified as CWE-307 and has a CVSS score of 5.3 (medium severity). The issue is fixed in version 26.1.7.
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6.
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE methods, allowing authenticated GET requests to bypass CSRF verification. As a result, a malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended service reloads and configuration changes through configd. This results in an authenticated Cross‑Site Request Forgery vulnerability allowing unauthorized system state changes. This vulnerability is fixed in 26.1.4.
CVE-2025-13698 is a medium-severity path traversal vulnerability in Deciso OPNsense version 25.7, specifically in the diag_backup.php component. It allows an authenticated network-adjacent attacker to create arbitrary files with root privileges by exploiting improper validation of user-supplied file paths. The vulnerability does not impact confidentiality or availability but can severely affect system integrity. Exploitation requires high privileges (authentication) but no user interaction. There are no known exploits in the wild currently. European organizations using OPNsense 25.7, especially those in critical infrastructure or government sectors, should prioritize patching or mitigating this issue. Mitigations include strict input validation, restricting file write permissions, and monitoring for unusual file creation activities.