GHSA-f35q-c34m-pfw3

The PPP password is not checked for line breaks. OPNsense writes it into the mpd5 configuration file /var/etc/mpd_.conf without quotes (src/etc/inc/interfaces.inc, line 1273), so each line break in the password starts a new line in the file, and a user with only the privilege 'Interfaces: PPPs: Edit' can inject arbitrary mpd5 directives. The directive set iface up-script is only accepted by mpd5 in bundle context, so the payload injects create bundle static ... (accepted in any context), sets the up-script on that bundle, then creates a link bound to that bundle and opens it. mpd5 runs the up-script as a root shell command when that link's IPCP comes up: arbitrary command execution as root

Scope is сhanged because mpd5 runs as root, outside the web application. The fix for GHSA-fq94-cxvc-9r7w (CVE-2026-57154) touched this page but added only a username check; the password field was left unchecked, so releases carrying that fix are still affected.