Unvalidated CSV Handling in OPNsense Firewall Affects GeoIP Import Mechanism

CVE-2026-57155

What is CVE-2026-57155?

OPNsense, a FreeBSD-based firewall, is vulnerable due to the unvalidated handling of CSV country codes in its GeoIP importer's processing paths. When an attacker has 'Firewall Alias Edit' privileges, they can manipulate the GeoIP source URL and submit a malicious archive. This manipulation allows the attacker to traverse directories, leading to the potential execution of arbitrary commands as root. This is achievable through the default cron job that utilizes excessively large log files, resulting in a total compromise of the firewall's security. The issue has been addressed in version 26.1.11, reinforcing the necessity to update promptly.

References