Critical 9.9Published Oct 15, 2026

CVE-2026-57155OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

Updated under an hour ago (2026-10-19 09:00 UTC)

Does this affect you?

It affects opnsense core. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.86%, higher than 58% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for opnsense core

Exploited in the last 30 days

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.

CVSS: 9.9 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-22, CWE-73, CWE-78
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.86% (percentile 58)
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

opnsense core opnsense:core (from the name)	before 26.1.11	CNA record

References

https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3x-refsource-confirm
https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48x-refsource-misc
https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fax-refsource-misc
https://hackerask.com/posts/opnsensex-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.