OPNMGR - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/opnmgr/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 16:37:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOPNMGR: Unauthenticated path traversal (CVE-2026-103978)https://feed.craftedsignal.io/briefs/2026-10-opnmgr-path-traversal/Fri, 23 Oct 2026 16:37:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-opnmgr-path-traversal/OPNMGR versions prior to 3.10.0 are vulnerable to an unauthenticated path traversal attack in the snyk_scan_progress.php file, allowing remote attackers to read sensitive .json files on the server.OPNMGR, a PHP-based OPNsense fleet manager, contains a critical path traversal vulnerability (CVE-2026-103978) in the 'snyk_scan_progress.php' endpoint. The endpoint fails to perform authentication or input sanitization on the 'scan_id' parameter, which is concatenated directly into a file path and passed to 'file_get_contents()'. Because the application forces a '.json' file extension, attackers can only retrieve files ending in this extension. However, this is sufficient to access sensitive files such as configuration files, service account credentials, and API keys. The vulnerability was disclosed via GitHub Security Advisory GHSA-8x7v-vwpx-3wr7 and fixed in version 3.10.0.

Impact

Successful exploitation allows an unauthenticated remote attacker to read arbitrary '.json' files accessible by the web server (typically 'www-data'). In the context of OPNMGR, this poses a high risk of exposing firewall API keys, service credentials, and internal configuration secrets.

Recommendation

  • Upgrade OPNMGR to version 3.10.0 or later immediately.
  • Implement access control lists (ACLs) to restrict network access to the OPNMGR web root if immediate patching is not possible.
  • Audit logs for the 'snyk_scan_progress.php' endpoint for anomalous 'scan_id' requests containing directory traversal sequences (e.g., '..').
]]>highadvisoryweb-application-vulnerabilitypath-traversalphpopnsense