{"schema":"threatline.record/2","record":{"id":"CVE-2026-58393","aliases":["GHSA-2m9v-p7r9-gfcw"],"summary":"OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files","details":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.","categories":["Unclassified"],"product":"core","vendor":"opnsense","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58393","source_modified_at":"2026-10-15T16:07:55.688Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"core","vendor":"opnsense","versions":[{"status":"affected","version":"< 26.1.11"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","source_modified_at":"2026-07-02T12:41:12Z","fetched_at":"2026-10-23T19:58:35.668311Z","package":{"ecosystem":"","name":"opnsense/core "},"range":"<= 26.1.10, <= 26.4.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","source_modified_at":"2026-07-02T12:41:12Z","fetched_at":"2026-10-23T19:58:35.668311Z","package":{"ecosystem":"","name":"opnsense/core "},"version":"26.1.11"},{"source":"GitHub Advisory Database","source_url":"https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","source_modified_at":"2026-07-02T12:41:12Z","fetched_at":"2026-10-23T19:58:35.668311Z","package":{"ecosystem":"","name":"opnsense/core "},"version":"26.4.1p1"}],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00433,"percentile":0.36587,"score_date":"2026-10-23"},"published_at":"2026-10-15T15:15:45.924Z","modified_at":"2026-10-15T16:07:55.688Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-58393","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T16:07:55.688Z"},{"source":"GitHub Advisory Database","url":"https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","fetched_at":"2026-10-23T19:58:35.668311Z","source_modified_at":"2026-07-02T12:41:12Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58393","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T16:07:43.427308Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T16:07:55.688Z","content_hash":"74ff8354433552df54fa853cc5bd08b8bd39e65d09b23dc0f12e91bf6d790c8e"}}