A flaw in the NTP GPS configuration page of OPNsense allows an attacker who can grant the page‑services‑ntp‑gps permission to store a value containing unescaped HTML and JavaScript. The system stores the initcmd parameter in base64, applies legacy_html_escape_form_data() to the encoded string, and then decodes it before rendering the textarea. Because decoding occurs after escaping, the stored HTML remains unescaped at the output sink, leading to a stored cross‑site scripting vulnerability that executes when any user opens the GPS page.

The vulnerability affects the OPNsense core product, a FreeBSD‑based firewall and routing platform. All releases prior to version 26.1.11 are impacted, as the security fix was applied in that release.

The CVSS score of 5.4 classifies the issue as moderate severity, while the EPSS score of < 1% indicates a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires an authenticated user with page‑services‑ntp‑gps privileges; the attacker can then inject and execute arbitrary client‑side code in the browsers of other users, read CSRF tokens, and perform authenticated actions, including those normally reserved for administrators.