OPNsense EUVD-2026-102114

Attacker must hold an authenticated account with the 'Firewall Alias Edit' privilege and must be able to configure a GeoIP alias pointing to an attacker-controlled source URL - a non-default alias configuration the operator supplies. The supplied archive's CSV country_code must contain traversal characters so process_zip()/process_gzip() write files (with -IPv4/-IPv6 suffixes) outside /usr/local/share/GeoIP/alias. Full root code execution additionally requires planting a crafted newsyslog fragment plus an oversized log file so the default hourly root cron job runs the payload. Limiting factors: exploitation is gated by the Firewall Alias Edit privilege (not unauthenticated), depends on the attacker controlling the GeoIP source archive contents, and relies on the default hourly root cron/newsyslog behavior being present; affected only prior to version 26.1.11.

CVSS is 9.9 (critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a network-reachable, low-complexity attack that escapes its privilege boundary (S:C) to achieve full compromise. The key tempering signal is PR:L: exploitation requires an already-authenticated account holding the 'Firewall Alias Edit' privilege, so this is a privilege-escalation-to-root primitive for a semi-trusted operator rather than an unauthenticated internet-facing bug. No EPSS probability score and no CISA KEV status were provided in the input, so exploitation-likelihood and active-exploitation signals cannot be assessed quantitatively - their absence should be treated as 'unknown', not 'low'. No SSVC decision data was supplied. The root cause (unvalidated two-character country_code used in output filenames) is confirmed by the vendor advisory and the patch commit diff, which makes the vulnerability highly credible and straightforward to weaponize once an attacker has the required privilege. The realistic priority is high for environments with multiple firewall administrators, delegated/role-based access, or MSP/multi-tenant management where an Alias-Edit operator is not fully trusted; it is lower for single-admin deployments where the only accounts able to reach this code already have full root-equivalent control.

An authenticated user with the Firewall Alias Edit privilege (for example a delegated junior admin or a compromised limited operator account) creates a GeoIP alias pointing at an attacker-controlled source URL and uploads an archive whose CSV country_code value contains path-traversal sequences. The importer, running as root, writes the attacker's content (a crafted newsyslog fragment plus an oversized log file) to a directory outside the intended GeoIP path, and the default hourly root cron job then executes the planted commands as root. A detailed technical write-up exists publicly (hackerask.com), but no confirmed weaponized exploit code was provided in the input.