CVE-2026-58393 Details
Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.
A path traversal vulnerability has been identified in OPNsense versions prior to 26.1.11, within the OpenVPN Client Specific Override feature. The issue arises because the common_name field in the Client Specific Override allows path traversal sequences. The function openvpn_csc_conf_write() then concatenates this value into a file path without proper normalization or a basename check, writing it to /var/etc/openvpn-csc/<vpnid>/<common_name>. This vulnerability can be exploited by an authenticated user with Client Specific Override privileges, who can store a traversal value that, when processed during an OpenVPN client-connect or authentication event, results in a generated CSO file being written outside the intended directory. The content of the file consists of OpenVPN configuration data, rather than arbitrary bytes. Exploitation requires the attacker to trigger a matching common name or username to be processed.
Users can upgrade to OPNsense version 26.1.11 or 26.4.1p1, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98 | [email protected] | Source CodeVendor |
| https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72 | [email protected] | Source CodeVendor |
| https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OPNsense | <= 26.1.10 (semver) <= 26.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |