CVE-2026-57155
Received Received - Intake

OPNsense Firewall Alias GeoIP Importer Path Traversal Vulnerability

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-57155
EUVD
EUVD-2026-102114

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core < 26.1.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57155 is a critical remote code execution (RCE) vulnerability in OPNsense's GeoIP Alias Importer. It allows an attacker with only the Firewall: Alias: Edit privilege to gain full root access to the firewall. The flaw stems from an arbitrary file write vulnerability where the unsanitized country_code field in a downloaded GeoIP database is used to name output files without validation, enabling directory traversal.

Detection Guidance

To detect this vulnerability, check if your OPNsense version is below 26.1.11. Run 'opnsense-version' in the shell to verify. Inspect GeoIP alias configurations for suspicious URLs or malformed country codes. Review logs in /var/log/system.log for unauthorized file writes or newsyslog activity.

Impact Analysis

An attacker can exploit this to write arbitrary files as root, escalate privileges, and execute commands via the default hourly root cron job. This results in complete firewall compromise, allowing full control over the system, data theft, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, violating compliance requirements for GDPR, HIPAA, and other standards that mandate strict access controls, data protection, and audit logging.

Mitigation Strategies

Immediately upgrade OPNsense to version 26.1.11 or later. Disable GeoIP alias imports if not required. Restrict 'Firewall: Alias: Edit' privileges to trusted users only. Monitor /usr/local/share/GeoIP/alias for unexpected files and review cron jobs for newsyslog modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57155. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart