OPNsense EUVD-2026-102115

Exploitation requires an authenticated user holding OPNsense OpenVPN Client Specific Override privileges, who stores a path-traversal sequence (e.g. ../) in the CSO common_name field - the exact unsanitized input consumed by openvpn_csc_conf_write() via the client_connect.php and user_pass_verify.php event handlers. The write does not occur until a matching OpenVPN client-connect or authentication event is processed with that common name/username, so the attacker must also cause such an event to fire. Key limiting factors: (1) operator-level privilege and access to CSO configuration are prerequisites; (2) the written payload is generated OpenVPN configuration content, not arbitrary attacker-controlled bytes, limiting what can be achieved by overwriting a target file; (3) the traversal only affects systems running the OpenVPN server with Client Specific Override entries prior to version 26.1.11.

This is a medium-severity (CVSS 5.9) path traversal (CWE-22) that the combined signals place well below genuine emergency priority. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L is network-reachable but gated by two meaningful brakes: AC:H and PR:L. PR:L is confirmed authenticated access, and the description sharpens this to a specific role - a user holding Client Specific Override privileges, which is an administrative/operator capability, not an ordinary low-privileged account. AC:H is justified because exploitation is not self-contained: the attacker must additionally cause a matching OpenVPN client-connect or authentication event (a client presenting the matching common name/username) before the malicious CSO file is written. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV status is not listed (no active exploitation signal) and no POC/exploit code is referenced - no public exploit identified at time of analysis. The impact is further constrained by the vulnerability's own mechanics: the file written is generated OpenVPN configuration content, not attacker-controlled arbitrary bytes, which caps the realistic integrity damage well below what I:H alone would imply. Net assessment: a real but lower-tier issue - an authenticated, operator-privileged, multi-condition flaw in a single product rather than a widely-weaponizable remote bug. Note one tension worth flagging: the official I:H rating sits uneasily with the description's explicit statement that content is generated config rather than arbitrary bytes, which argues for a lower integrity impact - verify intended file-overwrite consequences against the vendor advisory GHSA-2m9v-p7r9-gfcw.

An authenticated OPNsense operator with Client Specific Override privileges sets an OpenVPN CSO common_name containing path traversal sequences (e.g. ../../). When a VPN client subsequently connects or authenticates with a matching common name/username, openvpn_csc_conf_write() concatenates the unsanitized value into the target path and writes a generated OpenVPN config file outside /var/etc/openvpn-csc/<vpnid>/, potentially clobbering a file elsewhere on the FreeBSD host. No public exploit code is referenced, and the attacker must still engineer the matching connect/auth event, so this is a deliberate, privileged action rather than drive-by exploitation.