OPNsense EUVD-2026-102135

Requires a deployment with more than one user account: the attacker must hold the page-system-certmanager privilege to create/edit a certificate and inject HTML metacharacters into its description field. Exploitation only triggers when a separate, typically higher-privileged user navigates to the System Settings > Administration page, which renders the unescaped descr in the SSL Certificate selector (required user interaction, UI:R). Limited to OPNsense core versions prior to 26.1.11; single-admin deployments or those not provisioning the certmanager privilege to untrusted users are not realistically exposed. Authentication is required (CVSS PR:H confirms a high-privilege account).

This is a stored (persistent) cross-site scripting flaw (CWE-79) rated CVSS 5.2 (Medium). The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R is self-limiting on two independent axes: PR:H means the attacker must already hold the page-system-certmanager privilege (a high-trust role that can manage certificates), and UI:R means a second victim user must actively open System Settings > Administration for the payload to fire. No EPSS score, KEV listing, SSVC decision data, or public POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the only external signals are the vendor GHSA advisory and the fix commits. The practical risk is therefore a privilege-escalation/lateral-trust-abuse primitive: a lower-trust certificate operator can target a higher-privileged administrator, which matters because OPNsense is a firewall and admin-session compromise is high-value. Note a nuance to verify: the vendor assigns C:H while classic stored XSS impact is typically C:L/I:L - the C:H likely reflects that script running in an admin's authenticated firewall session can read sensitive configuration, so the elevated confidentiality rating is defensible but worth confirming against the GHSA. Overall this is a genuine but conditional issue (insider/multi-operator deployments), not an internet-facing mass-exploitation priority.

In an OPNsense deployment with multiple operators, a user holding only the page-system-certmanager privilege creates or edits a certificate and embeds HTML/JavaScript metacharacters in the certificate description field. When a firewall administrator later opens System Settings > Administration, the SSL Certificate selector renders the unescaped descr value and the attacker's script executes in the administrator's authenticated session. No public exploit code was provided, but the one-line fix commit (adding legacy_html_escape_form_data($a_cert)) makes the injection point trivially reproducible.