OPNsense Fixes Critical Privilege Escalation Flaw in GeoIP Importer

OPNsense has released version 26.1.11 to address a critical security vulnerability that allows for complete system compromise. The flaw, tracked as CVE-2026-57155, resides in the Firewall Alias GeoIP importer functionality of the FreeBSD-based firewall platform.

The vulnerability carries a CVSS score of 9.9, which the National Vulnerability Database classifies as critical. It stems from improper validation of country code values within the process_zip() and process_gzip() functions located in src/opnsense/scripts/filter/lib/alias/geoip.py. According to the NVD record, this issue enables an attacker with Firewall Alias Edit privileges to write arbitrary files as root.

Context and Background

The exploit chain begins when a user with Firewall Alias Edit privilege configures a GeoIP source URL controlled by an attacker. This attacker can supply a specially crafted archive containing a CSV file with a malicious country_code value. The application uses this unvalidated value to construct output filenames within the /usr/local/share/GeoIP/alias directory.

By manipulating the country code, the attacker can traverse into other existing directories on the system. This path traversal allows the attacker to write controlled content as the root user. The written files receive either an -IPv4 or -IPv6 suffix, depending on the specific configuration and attack vector employed.

The weakness is associated with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), CWE-73 (External Control of File Name or Path), and CWE-78 (OS Command Injection). These weaknesses combine to allow an attacker to place files in locations where system processes expect legitimate configuration or log data.

Who Is Affected

Any OPNsense installation running a version earlier than 26.1.11 is vulnerable to this attack. The flaw specifically impacts the core component responsible for importing GeoIP data for firewall aliases. Users who have granted the Firewall Alias Edit privilege to any account are at risk if that account is compromised or if an insider threat exists.

The severity of the issue is high because it leads to full system compromise. Once an attacker writes a crafted newsyslog fragment and an oversized log file to the system, they can leverage the default hourly root cron job. This cron job processes the malicious files, resulting in the execution of arbitrary commands with root privileges.

What should you do?

Administrators should immediately verify their current OPNsense version. If the system is running any version prior to 26.1.11, an update should be applied as soon as possible. The fix is included in version 26.1.11, which resolves the path traversal and command injection issues in the GeoIP importer.