The vulnerability arises from an unvalidated 'country_code' field in the GeoIP Alias Importer. An attacker with Firewall Alias Edit privilege can supply a crafted GeoIP source that includes path traversal sequences. This allows the importer to write arbitrary files below /usr/local/share/GeoIP/alias as root, resulting in attacker-controlled content with an -IPv4 or -IPv6 suffix. Coupled with a crafted newsyslog fragment and oversized log file, the default hourly root cron job can execute arbitrary commands as root, giving the attacker full control of the firewall system.

OPNsense version 26.1.10 and earlier of the core package are affected. The issue was fixed in version 26.1.11.

The CVSS score of 9.9 classifies this flaw as critical, while the EPSS score of less than 1% indicates a low exploitation probability at present. The vulnerability is not listed in CISA KEV. Although the attacker requires Firewall Alias Edit privilege, the high severity and the possibility of executing commands as root make it a severe risk once the privilege is obtained.