CVE-2026-57155 Details
Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
A critical vulnerability in OPNsense's GeoIP alias importer allows for arbitrary file writes as root, which can be escalated to remote code execution. This issue affects OPNsense versions through 26.1.10 and 26.4.1, with the vulnerability stemming from the importer's failure to validate country code values in CSV files. An attacker could exploit this by uploading a malicious GeoIP database that traverses directories, ultimately executing commands as root via a crafted log file.
Users can update to OPNsense version 26.1.11 or 26.4.1p1, both of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48 | [email protected] | Source CodeVendor |
| https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa | [email protected] | Source CodeVendor |
| https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3 | [email protected] | AdvisoryExploitRemedyVendor |
| https://hackerask.com/posts/opnsense | [email protected] | BundleExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OPNsense | <= 26.1.10 (semver) <= 26.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | New CVE Received | [email protected] |
| Oct 15, 2026 | CVE Modified | CISA-ADP |