Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

OPNsense firewall can be taken over via crafted GeoIP import

CVE-2026-57155 · published today
Summary

In OPNsense versions before 26.1.11, a user who can edit firewall aliases could supply a specially crafted GeoIP file that writes malicious files owned by the system administrator. Those files can be run by a regular system task, giving an attacker full control of the firewall. Update to version 26.1.11 or later to block this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
opnsense core < 26.1.11
Original advisory text
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Type
CWE-22Path Traversal
CWE-73External Control of File Name or Path
CWE-78OS Command Injection
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-57155 · NVD
CVE-2026-57155 · MITRE
Track software like this
Free during beta