{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/opnmgr--3.10.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:opnmgr_project:opnmgr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-103978"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OPNMGR (\u003c 3.10.0)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","path-traversal","php","opnsense"],"_cs_type":"advisory","_cs_vendors":["OPNMGR"],"content_html":"\u003cp\u003eOPNMGR, a PHP-based OPNsense fleet manager, contains a critical path traversal vulnerability (CVE-2026-103978) in the 'snyk_scan_progress.php' endpoint. The endpoint fails to perform authentication or input sanitization on the 'scan_id' parameter, which is concatenated directly into a file path and passed to 'file_get_contents()'. Because the application forces a '.json' file extension, attackers can only retrieve files ending in this extension. However, this is sufficient to access sensitive files such as configuration files, service account credentials, and API keys. The vulnerability was disclosed via GitHub Security Advisory GHSA-8x7v-vwpx-3wr7 and fixed in version 3.10.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated remote attacker to read arbitrary '.json' files accessible by the web server (typically 'www-data'). In the context of OPNMGR, this poses a high risk of exposing firewall API keys, service credentials, and internal configuration secrets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OPNMGR to version 3.10.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement access control lists (ACLs) to restrict network access to the OPNMGR web root if immediate patching is not possible.\u003c/li\u003e\n\u003cli\u003eAudit logs for the 'snyk_scan_progress.php' endpoint for anomalous 'scan_id' requests containing directory traversal sequences (e.g., '..').\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T16:37:42Z","date_published":"2026-10-23T16:37:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-opnmgr-path-traversal/","summary":"OPNMGR versions prior to 3.10.0 are vulnerable to an unauthenticated path traversal attack in the snyk_scan_progress.php file, allowing remote attackers to read sensitive .json files on the server.","title":"OPNMGR: Unauthenticated path traversal (CVE-2026-103978)","url":"https://feed.craftedsignal.io/briefs/2026-10-opnmgr-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - OPNMGR (\u003c 3.10.0)","version":"https://jsonfeed.org/version/1.1"}