CVE-2026-58391— OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
Quick assessment
Affected
opnsense core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OPNsense 是一个基于 FreeBSD 的防火墙和路由平台。在 26.1.11 版本之前，防火墙规则和 NAT 视图在 和 模板中，将存储的类别名称和别名描述直接放入 HTML 的 title 属性中，且未使用安全的引号编码。由于响应层使用的是 标志，双引号不会被转义而会原样保留，从而提前关闭了属性，使得攻击者可以向现有的 元素中注入事件处理程序属性。拥有防火墙类别或防火墙别名编辑权限的用户可以存储包含恶意内容的类别名称或别名描述；只要该类别被分配给某个过滤规则或 NAT 规则，或者该别名被某条规则用作源或目
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-58391
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
Source: CVE Program / CVE List V5
Vulnerability Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-58391
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58391
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-58391 (2)
Vendor Advisories for CVE-2026-58391 (1)
Security Blog Posts for CVE-2026-58391 (1)
Same Patch Batch · opnsense · 2026-10-15 · 10 CVEs total
| CVE-2026-57155 | 9.9 CRITICAL | OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer |
| CVE-2026-63442 | 8.1 HIGH | OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Block |
| CVE-2026-58390 | 8.0 HIGH | OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views |
| CVE-2026-53582 | 7.1 HIGH | OPNsense: XPATH Injection can disclose any secret in config.xml |
| CVE-2026-71490 | 7.1 HIGH | OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write prote |
| CVE-2026-58393 | 5.9 MEDIUM | OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated |
| CVE-2026-58392 | 5.4 MEDIUM | OPNsense: Stored XSS in Services: NTP GPS |
| CVE-2026-58394 | 5.2 MEDIUM | OPNsense: Stored XSS in Administration Settings via Certificate Description |
| CVE-2026-58395 | 4.3 MEDIUM | OPNsense: XPath injection in MVC safe-delete |
IV. Related Vulnerabilities
Same product: core
-
CVE-2026-71490
OPNsense: Direct comma-separated user privileges bypass OPNs -
CVE-2026-63442
OPNsense: Log Forgery via Login Username CRLF in WebGUI Auth -
CVE-2026-58390
OPNsense: Stored XSS to root RCE via OpenVPN client common_n -
CVE-2026-58394
OPNsense: Stored XSS in Administration Settings via Certific -
CVE-2026-58392
OPNsense: Stored XSS in Services: NTP GPS
Same vendor: opnsense
-
CVE-2026-71490
OPNsense: Direct comma-separated user privileges bypass OPNs -
CVE-2026-63442
OPNsense: Log Forgery via Login Username CRLF in WebGUI Auth -
CVE-2026-58390
OPNsense: Stored XSS to root RCE via OpenVPN client common_n -
CVE-2026-58394
OPNsense: Stored XSS in Administration Settings via Certific -
CVE-2026-58392
OPNsense: Stored XSS in Services: NTP GPS
Same weakness: CWE-79
-
CVE-2026-111284
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Act -
CVE-2026-111168
LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Conten -
CVE-2026-110878
Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Actio -
CVE-2026-111233
Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via fir -
CVE-2026-111232
Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separa
V. Comments for CVE-2026-58391
No comments yet