{"id":"CVE-2026-58394","title":"OPNsense is a FreeBSD based firewall and routing platform","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each …","severity":"medium","cvss":5.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","cwe":["CWE-79"],"vendor":"opnsense","product":"core","affected":["core < 26.1.11"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T19:17:41.880","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58394","references":[{"url":"https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb","label":"security-advisories@github.com"},{"url":"https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674","label":"security-advisories@github.com"},{"url":"https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j","label":"security-advisories@github.com"},{"url":"https://hackerask.com/posts/opnsense","label":"security-advisories@github.com"},{"url":"https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T18:35:21.476267Z"},"ingestedAt":"2026-10-15T16:13:11.488Z","slug":"CVE-2026-58394","body":"## Overview\n\nOPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":28.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":222677,"id":"CVE-2026-58394","ts":1792092517643,"field":"exploit_available","old":"false","new":"true"}]}