CVE-2026-58393

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11

Description The OpenVPN Client Specific Override common name field allows path traversal sequences. The function openvpn csc conf write() concatenates this value into the path /var/etc/openvpn-csc/<vpnid>/<common name> without normalization or a basename check. This affects the client connect.php and user pass verify.php event handlers. An authenticated user with Client Specific Override privileges can store a traversal value, which, during a matching OpenVPN client-connect or authentication event, results in a generated CSO file being written outside the intended directory. The written content consists of generated OpenVPN configuration rather than arbitrary bytes.

Recommendations Update to version 26.1.11.