Threats affecting pkg:github/opnsense/plugins/os-acme-client

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Critical	9.4	CVE-2026-123025OPNsense os-acme-client · OS Command Injection Critical9.42026-11-05CVE Database V5CVE-2026-123025 CVE-2026-123025 is a critical OS Command Injection vulnerability in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin up to version 4.17. A remote authenticated user with privileges to issue or renew certificates via the WebGUI or API can execute arbitrary commands as root due to unsafe interpolation of user-controlled fields into shell commands without validation or escaping. Vulnerability CWE-78	CVE Database V5	2026-11-05

Page 1 of 1 · 1 duplicate CVE record merged