Key points
- CVE-2026-57155 is rated Critical with a CVSS score of 9.9.
- The flaw affects OPNsense core versions earlier than 26.1.11.
- A fix is available in version 26.1.11.
OPNsense versions prior to 26.1.11 contain a critical security flaw that allows an attacker to gain full control of the firewall. The issue resides in the GeoIP importer functionality. Users with Firewall Alias Edit privileges can trigger the vulnerability by configuring a malicious GeoIP source URL. This allows an attacker to write files to the system as root.
In plain English
The vulnerability involves how OPNsense processes GeoIP data files. When the system imports these files, it uses country codes to name output files. The code does not properly validate these country codes. An attacker can supply a crafted archive containing a malicious country code. This code tricks the system into writing files into existing directories outside the intended location.
The background
According to the National Vulnerability Database, this issue is tracked as CVE-2026-57155. It has a CVSS score of 9.9, which is rated as Critical. The weaknesses involved include path traversal and command injection. The flaw allows an attacker-controlled newsyslog fragment to be written. This fragment can then be executed by the default hourly root cron job.
What changes now
OPNsense has released version 26.1.11 to address this vulnerability. This update fixes the unvalidated input handling in the GeoIP importer scripts. The fix prevents attackers from using country codes to traverse directories and write arbitrary files. Systems running this version or later are no longer affected by this specific privilege escalation path.
Who needs to act first
Teams should prioritize updating internet-facing firewalls immediately. Check which systems have users with Firewall Alias Edit privileges. Back up current configurations before applying the update. Test the update in a non-production environment if possible. Verify that the GeoIP import feature works correctly after the patch. Monitor logs for any unusual file creation attempts during the transition.
Background: Path traversal vulnerabilities
Prevent path traversal by enforcing strict allowlists for permitted file names, using chroots to isolate processes, and canonicalizing paths to resolve symbolic links. Avoid relying solely on input filtering, as attackers can encode slashes or use null bytes to bypass basic checks.
Read the full guide: Stop Path Traversal Attacks: Defense Strategies That Actually Work
What to do and how to stay safe: OPNsense
- Identify all OPNsense instances running versions earlier than 26.1.11.
- Schedule an immediate update to version 26.1.11 for all affected systems.
- Review firewall alias configurations for any suspicious GeoIP source URLs.
- Monitor system logs for unexpected file writes or cron job executions.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-57155?
The CVSS score is 9.9, which is rated as Critical.
Which OPNsense versions are affected by this flaw?
All versions prior to 26.1.11 are affected.
Is there a fix available for this vulnerability?
Yes, the issue is fixed in version 26.1.11.
