{"schema":"threatline.record/2","record":{"id":"CVE-2026-58394","aliases":["GHSA-8pgr-x852-qx4j"],"summary":"OPNsense: Stored XSS in Administration Settings via Certificate Description","details":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.","categories":["Unclassified"],"product":"core","vendor":"opnsense","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58394","source_modified_at":"2026-10-15T18:36:57.734Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"core","vendor":"opnsense","versions":[{"version":"< 26.1.11","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":5.2,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00239,"percentile":0.1418,"score_date":"2026-10-23"},"published_at":"2026-10-15T15:20:15.232Z","modified_at":"2026-10-15T18:36:57.734Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-58394","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T18:36:57.734Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58394","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://hackerask.com/posts/opnsense","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T18:35:21.476267Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T18:36:57.734Z","content_hash":"c9a083eabf2c951ee03efda44269baab9650d9f205bff9d0e63773b725fe96de"}}