CVE-2026-58394

5.2 Moyenne

Publiée le 15/10/2026 à 18:18 · Modifiée le 15/10/2026 à 23:08 · Analyse NVD reportée · Source : security-advisories@github.com

Description

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.

Traduire en français

Produits concernés

opnsense core

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.2 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb
https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674
https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j
https://hackerask.com/posts/opnsense
https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories