---
id: CVE-2026-58394
title: OPNsense is a FreeBSD based firewall and routing platform
summary: >-
  OPNsense is a FreeBSD based firewall and routing platform. Prior to version
  26.1.11, src/www/system_advanced_admin.php reads certificate records into
  $a_cert but omits that array from legacy_html_escape_form_data() before
  rendering each …
severity: medium
cvss: 5.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N'
cwe:
  - CWE-79
vendor: opnsense
product: core
affected:
  - core < 26.1.11
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:41.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58394'
references:
  - url: >-
      https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb
    label: security-advisories@github.com
  - url: >-
      https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674
    label: security-advisories@github.com
  - url: 'https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j'
    label: security-advisories@github.com
  - url: 'https://hackerask.com/posts/opnsense'
    label: security-advisories@github.com
  - url: 'https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T18:35:21.476267Z'
ingestedAt: '2026-10-15T16:13:11.488Z'
---

## Overview

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.