CVE-2026-53581— ntp: write path traversal
Quick assessment
Affected
opnsense core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OPNsense 是一个基于 FreeBSD 的防火墙与路由平台。在 opnsense/core 26.1.9 之前以及 BE/opnsense/core 26.4_20 之前，NTP 配置模块中存在一个路径遍历漏洞，允许攻击者以 root 用户身份覆盖系统中的任意文件。通过操纵 GPS 或 PPS 串口参数，拥有 NTP 配置访问权限的攻击者可以跳出预期目录，迫使系统将用户控制的数据写入文件系统中的任意文件。该问题已在 opnsense/core 26.1.9 和 BE/opnsense/core 26.4_20
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53581
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ntp: write path traversal
Source: CVE Program / CVE List V5
Vulnerability Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-53581
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53581
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-53581 (1)
-
🔗 ntp: write path traversal · Advisory · opnsense/core · GitHub Read full article x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: core
-
CVE-2026-85093
Cheshire Cat AI Memory Collection Endpoint Information Discl -
CVE-2026-57499
Liman: OS Command Injection in LogRotationController allows -
CVE-2026-66061
Home Assistant: iOS Companion app forwards NFC/QR tag scans -
CVE-2026-66060
Home Assistant: Unconfirmed NFC/QR tag scans allow silent au -
CVE-2026-59717
Home Assistant Companion: `homeassistant://invite` Deep Link
Same vendor: opnsense
-
CVE-2026-45158
OPNsense: Command Injection via Attacker-Controlled DHCP Con -
CVE-2026-44194
OPNsense: RCE on user managment -
CVE-2026-44195
OPNsense: Authentication lockout bypass -
CVE-2026-44193
OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_co -
CVE-2026-34578
OPNsense has an LDAP Injection via Unsanitized Username in A
Same weakness: CWE-22
-
CVE-2026-87023
Tanium addressed a path traversal vulnerability in Comply. -
CVE-2026-87030
Tanium addressed a path traversal vulnerability in Comply. -
CVE-2026-14505
Tanium addressed a path traversal vulnerability in Tanium Da -
CVE-2026-86079
n8n: Path Injection in Elasticsearch and ElasticSecurity Nod -
CVE-2026-78624
Improper Path Validation in Okta Access Gateway Backup and R
V. Comments for CVE-2026-53581
No comments yet