GHSA-r23v-737v-6r5h

A user with Captive Portal template permission can submit a small, highly compressed ZIP whose processing expands to gigabytes, causing memory pressure and process termination. Reproduced on OPNsense Community 26.7.8_2 amd64 in a 4 GiB VM.

CaptivePortal/Api/TemplateController.php accepts base64 ZIP content at /api/captiveportal/template/save_template and invokes the captiveportal strip_template backend action. src/opnsense/scripts/captiveportal/strip_template.py reads entire ZIP members with zf_in.read(zf_info.filename) and rewrites them without a cap on expanded member or archive size. Relevant source: src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/Api/TemplateController.php and src/opnsense/scripts/captiveportal/strip_template.py. Suggested fix: enforce a bounded total and per-member uncompressed size, stream through capped readers, and reject oversized expansion before allocating it.