CVE-2026-53581: ntp: write path traversal
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core patch the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opnsense/coreto a version that resolves this vulnerability.Fixed in 26.1.9 - Upgrade
Upgrade
BE/opnsense/coreto a version that resolves this vulnerability.Fixed in 26.4_20
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to the NTP configuration and must be able to manipulate the GPS or PPS serial port parameter. The stated attack vector is network-accessible, but the vulnerability requires high privileges.
What is the impact of successful exploitation?
The attacker can escape the intended directory and overwrite arbitrary files on the filesystem with user-controlled data. File writes occur as the root user, which can lead to high confidentiality and availability impact and partial integrity impact.
Which releases fix the vulnerability?
The issue is patched in opnsense/core version 26.1.9 and BE/opnsense/core version 26.4_20.