CVE-2026-58393 OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files
Authenticated users with CSO privileges can write OpenVPN config files outside intended directories via path traversal in common_name.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58393?
CVE-2026-58393 is a medium-severity path traversal vulnerability in opnsense core, published on 15 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.
Weakness: CWE-22
Which versions are affected by CVE-2026-58393?
How do I fix CVE-2026-58393?
No fix has been published for CVE-2026-58393 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-58393 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58393 exists.
Sources
Also known as GHSA-2m9v-p7r9-gfcw.