Netgate Pfsense

pfSense CE 2.7.1-2.9.0 Reflected XSS in firewall_rules.php
CVE-2026-111233 2.3 - Low - October 15, 2026

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.

XSS

Netgate pfSense CE 2.3.0-2.9.0 Stored XSS via separator color
CVE-2026-111232 4.8 - Medium - October 15, 2026

Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.

XSS

pfSense CE <=2.9.0 LFR via DDNS client (services_dyndns_edit.php)
CVE-2026-111230 6.9 - Medium - October 15, 2026

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.

External Control of File Name or Path

CVE-2026-111231
CVE-2026-111231 - October 15, 2026

CVE-2026-111229
CVE-2026-111229 - October 15, 2026

pfSense CE 2.7.1-2.9.0 Unbound CRLF Injection via services_unbound_advanced.php
CVE-2026-111228 5.1 - Medium - October 15, 2026

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.

CRLF Injection

pfSense CE 2.9.0 Unbound ACL CRLF Injection
CVE-2026-111227 5.1 - Medium - October 15, 2026

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.

CRLF Injection

pfSense CE 2.4.52.9.0 OS command injection in sshguard config
CVE-2026-111226 8.6 - High - October 15, 2026

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.

Shell injection

pfSense CE 2.5.0-2.9.0 OS Command Injection in openvpn.learn-address.sh
CVE-2026-111225 2.3 - Low - October 15, 2026

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.

Shell injection

Netgate pfSense CE 2.7.0-2.9.0 Config Injection (login_banner) Root Exec
CVE-2026-111223 8.6 - High - October 15, 2026

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.

Injection

pfSense CE <=2.9.0 OpenVPN openvpn.connect_async.sh OS command injection
CVE-2026-111224 7.7 - High - October 15, 2026

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

Shell injection

pfSense CE <=2.9.0 php.ini injection via timezone (auto_prepend_file)
CVE-2026-111222 7.5 - High - October 15, 2026

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.

CRLF Injection

CVE-2026-111221
CVE-2026-111221 - October 15, 2026

pfSense CE 2.9.0 Newline Injection in services_pppoe_edit.php (MPD5)
CVE-2026-111219 7.5 - High - October 15, 2026

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.

CRLF Injection

pfSense CE <2.9.0 Crontab Injection via interfaces_ppps_edit.php
CVE-2026-111220 8.6 - High - October 15, 2026

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

CRLF Injection

Netgate pfSense CE 2.7.0-2.9.0 OS Command Injection in Traffic Shaper
CVE-2026-111218 8.6 - High - October 15, 2026

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.

Shell injection

pfSense CE 2.9.0 OS command injection (CARP VHID)
CVE-2026-111217 8.6 - High - October 15, 2026

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.

Shell injection

pfSense CE 2.9.0 dpinger OS Command Injection via IPv6 Zone Index
CVE-2026-111216 8.6 - High - October 15, 2026

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.

Shell injection

pfSense CE 2.9.0 OS Cmd Injection via Wireless Interface Name
CVE-2026-111215 8.6 - High - October 15, 2026

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.

Shell injection

pfSense CE 2.7.0-2.9.0 OS Command Injection via QinQ Interface
CVE-2026-111214 8.6 - High - October 15, 2026

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

Shell injection

Cross Site Scripting in Netgate pfSense 26.03.1-RELEASE via pfBlockerNG
CVE-2026-78902 6.1 - Medium - September 25, 2026

Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package

XSS

XSS in Netgate pfSense RSS Widget (V2.8.1, 25.11.1/26.03)
CVE-2026-38961 5.4 - Medium - September 04, 2026

Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any authenticated user who views the dashboard, due to insufficient sanitization of feed title data before rendering in the widget.

XSS

Authenticated XSS via schedule descr param in pfSense <26.07/CE <2.9
CVE-2026-56128 5.1 - Medium - September 03, 2026

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

XSS

pfSense Plus <=26.07 & CE <=2.9.0 Auth XSS via firewall descr
CVE-2026-56127 5.1 - Medium - September 03, 2026

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.

XSS

Auth JS Injection in pfSense <=26.07 / CE 2.9.0 via /status_monitoring.php
CVE-2026-56126 5.1 - Medium - September 03, 2026

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.

XSS

pfSense (Plus & CE) Stored XSS in Traffic Graphs TopTalkers (v26.07/2.8.1)
CVE-2026-67189 5.3 - Medium - August 19, 2026

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution.

XSS

pfSense CE 2.7.2 RCE via Module Installer Serialized PHP Object
CVE-2025-69690 9.1 - Critical - May 08, 2026

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

Marshaling, Unmarshaling

Netgate pfSense Suricata Path Traversal RCE
CVE-2025-12490 - November 06, 2025

Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability. The specific flaw exists within the Suricata package. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root. Was ZDI-CAN-28085.

Directory traversal

Stored XSS in pfSense CE Suricata suricata_flow_stream.php
CVE-2025-34177 - September 09, 2025

In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.

XSS

XSS via unsanitized filehash on pfSense CE suricata_filecheck.php
CVE-2025-34175 - September 09, 2025

In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated.

XSS

Stored-XSS in pfSense CE Status Traffic Totals Page via unsanitized start-day
CVE-2025-34174 - September 09, 2025

In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.

XSS

CVE-2024-57273: pfSense CE <2.8.0 beta XSS in ACB 'reason' field
CVE-2024-57273 5.4 - Medium - May 14, 2025

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized "reason" field and a derivable device key generated from the public SSH key.

XSS

Netgate pfSense CE <2.8.0 Beta: OpenVPN Widget CMD Injection via remipp
CVE-2024-54780 - May 14, 2025

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.

XSS in pfSense v2.5.2 via interfaces_groups_edit.php ($pconfig injection)
CVE-2024-46538 4.8 - Medium - October 22, 2024

A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.

XSS

RCE via packet_capture.php in Netgate pfSense v23.05.1
CVE-2023-48123 8.8 - High - December 06, 2023

An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file.

Netgate pfSense 2.7.0 RCE via interfaces_gif_edit.php/gre_edit.php
CVE-2023-42326 8.8 - High - November 14, 2023

An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.

Command Injection

XSS in pfSense 2.7.0 status_logs_filter_dynamic.php
CVE-2023-42325 5.4 - Medium - November 14, 2023

Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.

XSS

CVE-2023-42327 XSS in Netgate pfSense 2.7.0 getserviceproviders.php Priv Esc
CVE-2023-42327 5.4 - Medium - November 14, 2023

Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.

XSS

Pfsense CE 2.6.0: No rate limit allows malicious user creation
CVE-2023-29973 4.9 - Medium - October 25, 2023

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall.

Allocation of Resources Without Limits or Throttling

XSS via RootFolder in Netgate pfSense 2.4.4 ACME v0.6.3
CVE-2020-21487 9.6 - Critical - April 04, 2023

Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php.

XSS

SSHGuard BruteForce Bypass in pfSense v22.05.1 & CE v2.6.0
CVE-2023-27100 9.8 - Critical - March 22, 2023

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.

Improper Restriction of Excessive Authentication Attempts

pfSense v2.7.0 Command Injection in restore_rrddata() via config.xml
CVE-2023-27253 8.8 - High - March 17, 2023

A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.

aka Blind XPath Injection

pfSense CE/Plus < 2.6.0/22.05: XSS in WebGUI via URL Table Alias
CVE-2022-29273 6.1 - Medium - February 22, 2023

pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.

XSS

pfBlockerNG <=2.1.4_27 Remote Exec via Host Header in pfSense
CVE-2022-40624 9.8 - Critical - December 20, 2022

pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814.

Shell injection

Cross Site Scripting in Netgate pfSense 2.4.4-Release-p3 (ACME 0.6.3)
CVE-2020-21219 6.1 - Medium - December 15, 2022

Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.

XSS

pfSense 2.5.2 XSS in browser.php via crafted file name
CVE-2022-42247 6.1 - Medium - October 03, 2022

pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.

XSS

Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01)
CVE-2022-26019 8.8 - High - March 31, 2022

Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.

Directory traversal

Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01)
CVE-2022-24299 8.8 - High - March 31, 2022

Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.

Improper Input Validation

An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php
CVE-2020-19203 - July 12, 2021

An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier. The widget did not encode the descr (description) parameter of wake-on-LAN entries in its output, leading to a possible stored XSS.

A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php
CVE-2020-19201 - July 12, 2021

A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr (description) parameter on NAT rules.