CVE-2026-58393
MEDIUM 5.9OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 37th percentile
Impact if exploited
5.9CVSS 3.1 · MEDIUM
- ConfidentialityNone
- IntegrityHigh
- AvailabilityLow
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-22: : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
References and research data (JSON)
All CVSS metrics
- MEDIUM 5.9 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L - MEDIUM 5.9 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw CVE record · GitHub_M · Updated 2026-10-15T15:15:45.924Z
CVE record · CISA-ADP · Updated 2026-10-15T16:07:55.688Z
NVD · CVE-2026-58393 · Updated 2026-10-15T21:08:49.703
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102115 EUVD · EUVD-2026-102115
Technical & other
- https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98 CVE record · GitHub_M · Updated 2026-10-15T15:15:45.924Z
NVD · CVE-2026-58393 · Updated 2026-10-15T21:08:49.703 - https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72 CVE record · GitHub_M · Updated 2026-10-15T15:15:45.924Z
NVD · CVE-2026-58393 · Updated 2026-10-15T21:08:49.703