CVE-2026-58394

MEDIUM 5.2

OPNsense: Stored XSS in Administration Settings via Certificate Description

CVSS Score

5.2

EPSS Score

0.0%

EPSS Percentile

0th

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.

CWE	CWE-79
Vendor	opnsense
Product	core
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for opnsense core

Be the first to know when new medium vulnerabilities affecting opnsense core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

opnsense / core

< 26.1.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j github.com: https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb github.com: https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674 hackerask.com: https://hackerask.com/posts/opnsense