Authenticated XSS via schedule descr param in pfSense <26.07/CE <2.9
CVE-2026-56128 Published on September 3, 2026
pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.
Vulnerability Analysis
CVE-2026-56128 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-56128 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-56128
Want to know whenever a new CVE is published for Netgate products? stack.watch will email you.
Affected Versions
Netgate pfSense Plus:- Before 26.07 is affected.
- Before 2.9.0 is affected.