EUVD-2026-52430
GHSA-2wfc-8j3p-p6cp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege network attacker injects payload (PR:L, AV:N); victim must view the page (UI:R); scope changes to victim session (S:C) with low C and I; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized description value is persisted and later rendered through the default cell formatter in opnsense_bootgrid.js, which assigns raw cell content to innerHTML, causing injected scripts to execute in the browser of any authenticated user who views the Firewall Rules page, enabling session hijacking or credential theft.
AnalysisAI
Stored cross-site scripting in OPNsense before 26.1.9 allows low-privileged authenticated attackers holding firewall rule management rights to inject arbitrary JavaScript into rule description fields via the filter API, which then executes in any authenticated administrator's browser when the Firewall Rules page is loaded. Impact is limited to subsequent-system effects - session hijacking or credential theft targeting other authenticated users - rather than direct host compromise. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in OPNsense 26.1.9 as of June 2, 2026.
Technical ContextAI
OPNsense is an open-source FreeBSD-based firewall and routing platform developed by Deciso B.V. (CPE: cpe:2.3:a:deciso_b.v.:opnsense). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. Rule descriptions submitted via the filter API endpoint were persisted without sanitization and later echoed directly into the HTML of firewall_rules.php using PHP's short echo tag (<?=$rule->getDescr();?>). The JavaScript library opnsense_bootgrid.js then assigns this raw cell content to innerHTML, causing any embedded HTML or JavaScript to be parsed and executed by the browser. The commit fix (b11d6b340716e240868ab19a369e058a46f0876f) wraps the output with html_safe(), applying proper HTML entity encoding before rendering, preventing the browser from interpreting description text as executable code.
RemediationAI
Upgrade OPNsense to version 26.1.9 or later, which applies the html_safe() output-encoding fix documented in commit b11d6b340716e240868ab19a369e058a46f0876f and included in the CE 26.1.9 release at https://docs.opnsense.org/releases/CE_26.1.html#june-02-2026. For environments where immediate upgrade is not feasible, reduce the attack surface by auditing and tightening firewall rule management privilege assignments - removing rule creation/edit rights from any account that does not strictly require them eliminates the injection vector. Additionally, audit all existing firewall rule descriptions for unexpected HTML tags or script content as a precautionary incident check. There is no single configuration toggle to disable the vulnerable rendering path without removing the Firewall Rules UI entirely, so privilege restriction is the most actionable compensating control.
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edit
DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Busines
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 al
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions
Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4
A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Busine
A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and
OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicio
OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allow
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject ma
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today