OPNsense up to 26.1.10 OpenVPN Client Specific Override client_connect.php openvpn_csc_conf_write common_name path traversal

Summaryinfo

A vulnerability identified as problematic has been detected in OPNsense up to 26.1.10. This affects the function openvpn_csc_conf_write of the file client_connect.php of the component OpenVPN Client Specific Override. Performing a manipulation of the argument common_name results in path traversal. This vulnerability is identified as CVE-2026-58393. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in OPNsense up to 26.1.10. This affects the function openvpn_csc_conf_write of the file client_connect.php of the component OpenVPN Client Specific Override. The manipulation of the argument common_name with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on integrity, and availability. The summary by CVE is:

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-58393 since 06/30/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

By approaching the search of inurl:client_connect.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 26.1.11 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• OPNsense

Version

• 26.1.0
• 26.1.1
• 26.1.2
• 26.1.3
• 26.1.4
• 26.1.5
• 26.1.6
• 26.1.7
• 26.1.8
• 26.1.9
• 26.1.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion