OPNsense core: Root remote code execution via arbitrary file write in GeoIP alias importer
Summary
OPNsense versions before 26.1.11 do not validate the country code read from GeoIP alias data when writing output files. A user with the Firewall: Alias: Edit privilege can point the GeoIP source to an attacker-controlled archive and write content to arbitrary locations as root. A crafted newsyslog configuration and an oversized log file can then trigger the default hourly root cron job to run commands, which can lead to full compromise of the firewall.
Affected
- OPNsense core versions before 26.1.11
Fixed in
- Fixed in OPNsense 26.1.11
Workaround
- Unknown. The vendor advisory does not list a workaround; patching is the fix.
Exploitation
- A public proof of concept has been published.
- Exploitation requires an authenticated user with Firewall: Alias: Edit privilege.
- CISA SSVC: exploitation status poc, automatable: no, technical impact: total.
- Reports of active exploitation are unverified; the CISA KEV listing could not be confirmed.
Our recommendation
- Update OPNsense to version 26.1.11 or later as a priority.
- Review all accounts with Firewall: Alias: Edit privilege and restrict them to trusted administrators.
- Restrict access to the web interface to internal networks or VPN.
- Check the GeoIP alias URL settings and the GeoIP directory for unexpected files with -IPv4 or -IPv6 suffixes.
- Monitor for unusual root activity and newsyslog changes.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
babyshen/CVE-2026-57155
Research sources
- GitHub Security Advisory GHSA-wjqq-rfmm-v5h3 github.com
- Fix commit c46aced9c47d956167e294911113bc334fea5f48 github.com
- Fix commit e7fbfaa7f5e070da667e3f243da11fd3d4b731fa github.com
- TheHackerWire: CVE-2026-57155 analysis www.thehackerwire.com
- SecurityOnline: OPNsense root RCE PoC securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:18.
Original description (NVD)
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
NVD references (5)
- https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48
- https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa
- https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3
- https://hackerask.com/posts/opnsense
- https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.