Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M

CVE-2026-58392OPNsense: Stored XSS in Services: NTP GPS

Medium 5.4

In plain English

A medium-severity cross-site scripting in core from opnsense. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 80.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.

Affected products (as reported)

Vendor	Product	Versions
opnsense	core	< 26.1.11

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5 x_refsource_CONFIRM
https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c x_refsource_MISC
https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e x_refsource_MISC
https://hackerask.com/posts/opnsense x_refsource_MISC