CVE-2025-13698 - Deciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation Vulnerability

Back Back to CVE browser

MEDIUM

Deciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation Vulnerability

Published Dec 23, 2025

4.5

MEDIUM

CVSS 3.0

EPSS 0.61%

Description

Deciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Deciso OPNsense. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of backup configuration files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root. Was ZDI-CAN-28133.

Affected products

Vendor Deciso Product OPNsense Default
n/a
- Version
  25.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Deciso

OPNsense

n/a

Version	Status	Constraints
25.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204967
Advisory
https://github.com/opnsense/core/commit/cb15c935137d05c86a1e6cf12af877e9c32a23af
vendor-advisory
https://www.zerodayinitiative.com/advisories/ZDI-25-1022/
x_research-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204967		Advisory
https://github.com/opnsense/core/commit/cb15c935137d05c86a1e6cf12af877e9c32a23af		vendor-advisory
https://www.zerodayinitiative.com/advisories/ZDI-25-1022/		x_research-advisory