The vulnerability allows a privileged user who can create client specific overrides to inject path traversal sequences in the common_name field. During a client-connect or authentication event, the server concatenates the supplied name when writing a configuration file, which can result in a file being placed outside the intended /var/etc/openvpn-csc/<vpnid> directory. The contents written are OpenVPN configuration data, not arbitrary bytes, but the ability to write files to arbitrary locations could be leveraged to modify existing configuration files or introduce misleading defaults, potentially impacting confidentiality or availability of the VPN service.

OPNsense core versions prior to 26.1.11 are affected. The issue is fixed in 26.1.11 and later releases.

The CVSS score is 5.9, indicating moderate severity. The EPSS score is reported as less than 1 %, implying a low likelihood of exploitation. The vulnerability requires an authenticated user with Client Specific Override privileges to set a specially crafted common_name value, and the client must later connect using that name or username for the filesystem write to occur. Because of these prerequisites, the practical attack potential is limited but the patch is advisable to eliminate the risk completely.