CVE-2026-58393
Received Received - Intake

OPNsense Path Traversal in OpenVPN Client Specific Override

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-58393
EUVD
EUVD-2026-102115

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core < 26.1.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in OPNsense's OpenVPN Client Specific Override (CSO) feature. An authenticated user with CSO privileges can insert path traversal sequences like ../../ into the common_name field. When the system generates a CSO file, it writes the file to an unintended directory outside the intended OpenVPN CSO directory. The vulnerability occurs because the common_name value is concatenated directly into the file path without validation or normalization.

Detection Guidance

Check for unexpected files in system directories like /tmp or outside the intended OpenVPN CSO directory (/var/etc/openvpn-csc/). Look for files with names matching common_name values containing path traversal sequences such as ../../../../. Review OpenVPN CSO configurations for unauthorized file paths or modifications.

Impact Analysis

An attacker could write files to arbitrary locations on the OPNsense system, potentially overwriting system files or creating files in sensitive directories like /tmp. This could lead to denial of service, unauthorized file access, or further exploitation of the system. Practical exploitation requires the attacker to trigger a matching common name or username during OpenVPN client-connect or authentication events.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized file access or modification on the OPNsense system. For GDPR, it may affect data integrity and security controls. For HIPAA, it could compromise protected health information if the system handles such data. Unauthorized file writes may violate integrity and access control requirements in these regulations.

Mitigation Strategies

Upgrade OPNsense to version 26.1.11 or later. If upgrading is not immediately possible, restrict access to the OpenVPN Client Specific Override feature to trusted users only. Monitor file system changes in /var/etc/openvpn-csc/ and /tmp for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58393. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart