core

OPNsense GUI 및 시스템 관리 OPNsense 프로젝트는 개발자들이 코드 베이스에 기여하기 시작하도록 초대합니다. 개인적인 목적이나, 더 나아가 가장 뛰어난 오픈소스 방화벽을 만드는 데 함께하기 위해서라면 더욱 환영합니다. 빌드 프로세스는 누구나 쉽게 코드를 작성하고 빌드할 수 있도록 설계되었습니다. 새로운 코드베이스의 주요 개요는 다음에서 확인할 수 있습니다: https://docs.opnsense.org/development/architecture.html 우리의 목표는 빅뱅 방식이 아닌 점진적으로 새로운 코드베이...

OPNsense - Cross-Site Scripting

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense before 23.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. id: CVE-2023-39002 info: name: OPNsense - Cross-Site Scripting author: Herry severity: medium description...

OPNsense <=20.1.5 - Open Redirect

OPNsense through 20.1.5 contains an open redirect vulnerability via the url redirect parameter in the login page, which is not filtered. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id:...

OPNsense - Cross-Site Scripting to RCE

There is a XSS in /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 via openAction in app/controllers/OPNsense/Cron/ItemController.php. id: CVE-2023-39007 info: name: OPNsense - Cross-Site Scripting to RCE author: ritikchaddha...

CVE-2026-53582

https://blog.evan.lat/posts/opnsense/ https://git.evan.lat/e/CVE-2026-53582...

CVE-2026-57155

https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3...

CVE-2026-53581

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

CVE-2026-53581 ntp: write path traversal

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

CVE-2026-53581 ntp: write path traversal

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

CVE-2026-53581 ntp: write path traversal

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

EUVD-2026-74293

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

CVE-2026-53581

OPNsense is a FreeBSD-based firewall and routing platform. A path traversal vulnerability in the NTP configuration module allows an attacker with access to NTP settings to manipulate the GPS or PPS serial port parameter , escaping the intended directory and forcing the system to write user-contro...

PT-2026-88518

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4 20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulati...

CVE-2026-53581: Improper Limitation of a Pathname to a Restricted Directory

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

CVE-2026-49131

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized...

CVE-2026-49132

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

CVE-2026-49132

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

CVE-2026-49132

OPNsense before 26.1.9 is affected by a stored XSS in the trust certificate API: when an attacker consolidates payloads into a certificate description, the unsanitized value is persisted and later rendered in the Dashboard Certificates widget (Certificates.js) via HTML attribute/text sinks, allow...

CVE-2026-49132 OPNsense < 26.1.9 Stored XSS via Certificate Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

EUVD-2026-52433

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...