OPNMGR: Unauthenticated path traversal (CVE-2026-103978)

OPNMGR, a PHP-based OPNsense fleet manager, contains a critical path traversal vulnerability (CVE-2026-103978) in the 'snyk_scan_progress.php' endpoint. The endpoint fails to perform authentication or input sanitization on the 'scan_id' parameter, which is concatenated directly into a file path and passed to 'file_get_contents()'. Because the application forces a '.json' file extension, attackers can only retrieve files ending in this extension. However, this is sufficient to access sensitive files such as configuration files, service account credentials, and API keys. The vulnerability was disclosed via GitHub Security Advisory GHSA-8x7v-vwpx-3wr7 and fixed in version 3.10.0.

Impact

Successful exploitation allows an unauthenticated remote attacker to read arbitrary '.json' files accessible by the web server (typically 'www-data'). In the context of OPNMGR, this poses a high risk of exposing firewall API keys, service credentials, and internal configuration secrets.

Recommendation

• Upgrade OPNMGR to version 3.10.0 or later immediately.
• Implement access control lists (ACLs) to restrict network access to the OPNMGR web root if immediate patching is not possible.
• Audit logs for the 'snyk_scan_progress.php' endpoint for anomalous 'scan_id' requests containing directory traversal sequences (e.g., '..').