CVE-2026-53581 ntp: write path traversal
An attacker with NTP configuration access can overwrite arbitrary files as root via path traversal in the GPS/PPS parameter, leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53581?
CVE-2026-53581 is a critical path traversal vulnerability in opnsense core, published on 8 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.
Which versions are affected by CVE-2026-53581?
How do I fix CVE-2026-53581?
No fix has been published for CVE-2026-53581 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-53581 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53581 exists.
Sources
Also known as GHSA-872g-g543-j37m.