Path traversal in OPNsense - CVE-2026-53581
Published: June 15, 2026 / Updated: September 10, 2026
Vulnerability identifier: #VU134542
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53581
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to overwrite arbitrary files on the system.
The vulnerability exists due to path traversal in the NTP configuration module when processing the GPS or PPS serial port parameter. A remote user can supply a specially crafted serial port value to overwrite arbitrary files on the system.
Successful exploitation can lead to total system compromise because the file write occurs as the root user. The target file must already exist.
Affected software
OPNsense
How to mitigate CVE-2026-53581
Install security update from vendor's website.
OPNsense - update to 26.1.9