CVE-2026-57155 | OPNsense up to 26.1.10 GeoIP Importer geoip.py process_zip/process_gzip country_code path traversal

October 15, 2026 Yanac

A vulnerability labeled as very critical has been found in OPNsense up to 26.1.10. This impacts the function process_zip/process_gzip of the file src/opnsense/scripts/filter/lib/alias/geoip.py of the component GeoIP Importer. Executing a manipulation of the argument country_code can lead to path traversal.

This vulnerability is tracked as CVE-2026-57155. The attack can be launched remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More