CVE-2026-57155

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.

• CWE-22
• CWE-73
• CWE-78

• https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48
• https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa
• https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3
• https://hackerask.com/posts/opnsense
• https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57145PraisonAI is a multi-agent teams system. Prior to 4.6.62, sr…9.1
• CVE-2026-57146PraisonAI is a multi-agent teams system. From version 4.5.11…7.5
• CVE-2026-57147PraisonAI is a multi-agent teams system. Prior to 0.1.6, pra…9.8
• CVE-2026-57148PraisonAI is a multi-agent teams system. Prior to 0.1.6, pra…9.8
• CVE-2026-57149plone.app.portlets.portlets provides a Plone-specific user i…9.9
• CVE-2026-5715The Voyage Plus plugin for WordPress is vulnerable to Stored…6.4
• CVE-2026-57156FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2026-57157FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-57158FreeRDP is a free implementation of the Remote Desktop Proto…9.1
• CVE-2026-57159PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2026-57160PJSIP is a free and open source multimedia communication lib…5.3
• CVE-2026-57161PJSIP is a free and open source multimedia communication lib…8.2