CVE-2026-58393 in OPNsense
Summary
by MITRE • 10/15/2026
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
OPNsense serves as a widely deployed firewall and routing platform built upon FreeBSD, providing critical network infrastructure for many organizations. A significant security vulnerability was identified within the OpenVPN client configuration management subsystem prior to version 26.1.11. This flaw centers on improper input validation regarding the common_name field used in Client Specific Overrides (CSO). The underlying code function openvpn_csc_conf_write() is responsible for generating and writing configuration files based on user-provided data. Specifically, this function concatenates the provided common_name value directly into a file path located at /var/etc/openvpn-csc/<vpnid>/<common_name> without performing any normalization or basename checks to ensure the input remains within the intended directory structure.
The technical nature of this flaw constitutes a classic Path Traversal vulnerability, often categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Because the application fails to sanitize special characters such as dot-dot-slash sequences in the common_name parameter, an attacker can manipulate the file path during concatenation. This allows for directory traversal out of the restricted /var/etc/openvpn-csc/ directory into arbitrary locations on the filesystem where the OpenVPN service process has write permissions. The vulnerability is triggered through specific event handlers within the OPNsense codebase, namely client_connect.php and user_pass_verify.php, which are invoked during VPN connection establishment or authentication processes.
From an operational perspective, this vulnerability impacts systems that utilize Client Specific Overrides to assign dynamic configurations to individual OpenVPN clients based on their identity. An authenticated attacker possessing privileges to manage CSO entries can inject path traversal sequences into the common_name field. When a subsequent event occurs where a matching client connects using the crafted name or authenticates with a corresponding username, the system processes this input and writes a generated configuration file outside of its intended sandboxed directory. While the content written is structured OpenVPN configuration data rather than arbitrary binary payloads, the ability to write files in unintended locations can lead to significant security implications. These may include overwriting critical system configuration files, disrupting service availability by corrupting essential settings, or potentially facilitating further exploitation if other vulnerabilities exist that allow execution of these crafted configuration files.
In terms of threat modeling and industry standards, this vulnerability aligns with the ATT&CK technique T1564: Hidden Files and Directories, as it allows an attacker to place artifacts in unexpected locations on the file system. It also relates to privilege escalation vectors if the written files can influence higher-privileged processes or core firewall rules. The impact is primarily confined to authenticated users who have been granted specific administrative rights related to OpenVPN client configurations, which limits the attack surface compared to unauthenticated remote code execution flaws but remains critical for internal threat actors or compromised credentials.
To mitigate this risk, organizations running OPNsense must upgrade immediately to version 26.1.11 or later, where the developers have implemented proper input validation and path normalization checks in the openvpn_csc_conf_write() function. Until an upgrade is performed, administrators should strictly limit access to CSO management interfaces to trusted personnel only and monitor system logs for unusual file creation events outside of standard directories. Regular auditing of configuration files in /var/etc/openvpn-csc/ can also help detect any attempted exploitation activities before they result in significant operational disruption or security compromise.