CVE-2026-58392

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11

Description The NTP GPS page in the firewall and routing platform improperly handles the initcmd variable in src/www/services ntpd gps.php. The system stores the value in base64 form, applies legacy html escape form data() to the encoded string, and subsequently uses base64 decode() to decode it into the GPS initialization-command textarea. Since decoding happens after escaping, stored HTML remains unescaped. A user with page-services-ntp-gps privileges can inject a value that closes the textarea, allowing script execution in the session of any user who views the page. This can lead to the theft of CSRF (Cross-Site Request Forgery) material—a technique used to trick a user into executing unwanted actions—and the performance of authenticated administrative actions.

Recommendations Update to version 26.1.11.