A notable security flaw, identified as CVE-2019-25368, has been discovered in OPNsense 19.1. This vulnerability involves multiple Cross-Site Scripting (XSS) issues that could allow an attacker to inject harmful code into your system. For users managing OPNsense installations, understanding this vulnerability and applying necessary updates is crucial for maintaining a secure network environment.
Cross-Site Scripting, or XSS, is a type of security flaw often found in web applications. It allows attackers to inject malicious scripts into web pages viewed by other users. In this specific case, the vulnerability exists within the diag_backup.php section of OPNsense. Attackers could craft special web requests (POST requests) that include these malicious scripts in several parameters, such as GDrive_GDriveEmail, GDrive_GDriveFolderID, Nextcloud_url, and others. If a logged-in administrator then views a page affected by this, the attacker’s script could run in their browser. This means the attacker could potentially do things an administrator can do, like change settings or steal session information, all without the administrator knowing.
CVE Details
- Product: OPNsense
- Published Date: February 15, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability primarily affects OPNsense version 19.1.
Current Status
This vulnerability has been thoroughly analyzed. The good news is that fixes were released shortly after its discovery. It’s important for users of the affected version to take action to protect their systems.
Severity Level
Rated as “Medium” severity with a CVSS score of 5.4, this vulnerability poses a significant risk because it targets administrative sessions. An attacker exploiting an XSS vulnerability within an authenticated administrator session could potentially execute arbitrary JavaScript commands. This could lead to unauthorized actions, data manipulation, or further compromise of the firewall if not addressed. While it requires an authenticated session, the potential impact highlights the importance of timely patching.
Possible Solutions
Fortunately, the OPNsense team promptly addressed these XSS vulnerabilities. The forum announcement indicates that “Uncoordinated cross site scripting issues have been fixed” in the OPNsense 19.1.1 release. Therefore, the most effective solution is to update your OPNsense installation to version 19.1.1 or a later stable release. Always ensure your systems are running the latest patched versions to benefit from critical security updates and maintain robust protection against known threats.
Regularly checking for and applying software updates is a fundamental practice in cybersecurity. For OPNsense users, staying current with releases helps safeguard your network infrastructure against evolving threats.
References
https://forum.opnsense.org/index.php?topic=11469.0
https://opnsense.org
https://www.exploit-db.com/exploits/46351
https://www.vulncheck.com/advisories/opnsense-reflected-xss-via-diagbackupphp
