CVE-2026-58392

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58392
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58392.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58392
Aliases
  • GHSA-h793-67jm-j4m5
Published
2026-10-15T15:18:32Z
Modified
2026-10-16T02:48:01Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
OPNsense: Stored XSS in Services: NTP GPS
Details

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58392.json"
}
References

Affected packages

Git / github.com/opnsense/core

Affected ranges

Type
GIT
Repo
https://github.com/opnsense/core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c930ab586ffe2d2e010e5135657e5e054316ff58
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "26.1.11"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

15.*
15.1
15.1.1
15.1.10
15.1.10.2
15.1.11
15.1.11.1
15.1.11.2
15.1.11.3
15.1.11.4
15.1.12
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.6.1
15.1.7
15.1.7.1
15.1.7.2
15.1.8
15.1.8.1
15.1.8.2
15.1.8.3
15.1.8.4
15.1.9
15.1.9.1
15.1.9.2
15.7
16.*
16.7.a
16.7.b
16.7.r
17.*
17.1.a
17.1.b
17.1.r
17.7.a
17.7.b
17.7.r
18.*
18.1.a
18.1.b
18.1.r
18.7.a
18.7.b
18.7.r
19.*
19.1.a
19.1.b
19.1.r
19.7.a
19.7.b
19.7.r
20.*
20.1.a
20.1.b
20.1.r
20.7.a
20.7.b
20.7.r
21.*
21.1.a
21.1.b
21.1.r
21.7.a
21.7.b
21.7.r
22.*
22.1.a
22.1.b
22.1.r
22.7.a
22.7.b
22.7.r
23.*
23.1.a
23.1.b
23.1.r
23.7.a
23.7.b
23.7.r
24.*
24.1.a
24.1.b
24.1.r
24.7.a
24.7.b
24.7.r
25.*
25.1.a
25.1.b
25.1.r
25.7.a
25.7.b
25.7.r
26.*
26.1
26.1.1
26.1.10
26.1.2
26.1.3
26.1.4
26.1.5
26.1.6
26.1.7
26.1.8
26.1.9
26.1.a
26.1.b
26.1.r
26.1.r1
26.1.r2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58392.json"