CVE-2026-56128 in pfSense Plus
Summary
by MITRE • 09/03/2026
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified involves a stored cross-site scripting flaw within pfSense Plus versions prior to 26.07 and pfSense CE versions prior to 2.9.0, specifically affecting the firewall scheduling subsystem. This security issue stems from insufficient input validation and sanitization mechanisms when handling user-supplied data in the schedule description field. An attacker who possesses authenticated access with the Firewall: Schedules: Edit privilege can inject arbitrary JavaScript code by crafting a malicious payload within the descr parameter of the /firewall_schedule_edit.php endpoint. The system fails to properly sanitize this input, allowing special characters and script tags to persist in the backend database without being neutralized or encoded appropriately for safe HTML rendering.
The technical root cause lies in how the stored data is subsequently rendered on the frontend interface. When an administrator views the firewall rules list via /firewall_rules.php, the system attempts to display the associated schedule descriptions within HTML attribute values. The existing sanitization logic applies only single-quote escaping, which proves insufficient against attackers who can utilize double quotes for context breakout. By injecting a payload that includes unescaped double quotes and JavaScript event handlers or script tags, an attacker can break out of the intended string context. This allows the malicious code to execute directly in the browser environment of any user viewing the affected page, effectively bypassing standard content security policies if not explicitly configured otherwise.
The operational impact of this vulnerability is significant due to its stored nature and broad execution scope. Unlike reflected XSS attacks that require social engineering to trick a specific victim into clicking a malicious link, this flaw persists in the system's data store. Consequently, any user with the Firewall: Rules privilege who accesses the rules list will trigger the execution of the injected script automatically. This enables an attacker to perform actions such as stealing session cookies, capturing sensitive configuration details displayed on the page, performing unauthorized administrative actions via cross-site request forgery techniques facilitated by the active session, or redirecting users to malicious external sites. The persistence of the payload means that every subsequent view of the affected schedule serves as a new attack vector without further interaction from the attacker.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents a stored variant where malicious scripts are permanently stored on target servers and delivered to victims when they request information from the server. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1059, Command and Scripting Interpreter, specifically through browser-based execution via JavaScript. It also relates to T1078, Valid Accounts, as it requires initial authentication with specific privileges, and potentially T1213, Data from Information Repositories, if the script is used to exfiltrate configuration data stored within the pfSense environment.
Mitigation strategies should focus on immediate patching and robust input validation practices. Administrators must upgrade their pfSense installations to version 26.07 or later for Plus editions, or 2.9.0 and later for CE editions, where these sanitization issues have been addressed by the vendor. In environments where upgrading is not immediately feasible, temporary mitigations include restricting access to the Firewall: Schedules: Edit privilege to only highly trusted users with strong multi-factor authentication controls. Additionally, implementing a strict Content Security Policy header that restricts script execution sources can help mitigate the impact of any successfully injected scripts by preventing them from loading external resources or executing inline code unless explicitly whitelisted. Regular security audits and penetration testing should be conducted to ensure that input validation logic correctly handles all edge cases involving quote escaping and HTML entity encoding across all administrative interfaces.