CVE-2026-97730 in pfSense Plus
Summary
by MITRE • 09/25/2026
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Netgate pfSense Plus prior to version 26.07 and pfSense CE prior to version 2.9.0 represents a critical Local File Inclusion flaw within the Dashboard subsystem, specifically affecting how the index.php script processes widget sequence data. This security defect arises from insufficient input validation when handling user-supplied parameters that define the order or configuration of dashboard widgets. An attacker who has obtained authenticated access with privileges sufficient to modify Dashboard settings can leverage this weakness to achieve arbitrary code execution on the underlying system. The core technical flaw lies in the application's failure to sanitize path traversal sequences embedded within the widget sequence values, allowing external file paths to be injected into the internal processing logic of the web interface.
To successfully exploit this vulnerability, an attacker must first establish a foothold that grants them the ability to write arbitrary files to specific directories on the pfSense firewall system, such as /tmp/test.widget.php. This prerequisite often stems from other misconfigurations or secondary vulnerabilities that allow file writes in accessible locations. Once the malicious PHP payload is placed at this location, the attacker submits a crafted widget sequence value containing path traversal payloads like ../../../../../../../../../../../tmp/test to the Dashboard configuration interface. The vulnerable code then interprets this input as a valid local file reference rather than rejecting it due to its non-standard or external nature. Consequently, the system includes and executes the arbitrary PHP file in the context of the web server process, typically running with elevated privileges associated with the pfSense administrative services.
The operational impact of this vulnerability is severe, resulting in complete compromise of the firewall appliance. By executing arbitrary PHP code through the Dashboard interface, an attacker can perform any action permitted by the web server user account on the host system. This includes reading sensitive configuration files containing credentials and encryption keys, modifying network rules to bypass security controls, installing persistent backdoors for long-term access, or pivoting to other systems within the protected network segment. Since pfSense serves as a critical perimeter defense device, compromising it effectively neutralizes the organization's primary line of defense against external threats while exposing internal assets to direct attack from an already compromised position.
This vulnerability aligns with Common Weakness Enumeration CWE-94, which describes Improper Control of Generation of Code (Code Injection), and more specifically CWE-22, Improvement in Limitation on Path Traversal Filename, as the root cause involves the inclusion of files based on unsanitized user input that allows directory traversal. In terms of tactical mapping within the MITRE ATT&CK framework, this exploit technique corresponds to T1059 Command and Scripting Interpreter via PHP execution, falling under the broader category of Execution techniques used by adversaries to maintain persistence or escalate privileges after initial access has been established through authentication bypass or credential theft.
Mitigation strategies must prioritize immediate patching to the latest stable releases of pfSense Plus 26.07 or later and pfSense CE 2.9.0 or later, where this input validation logic has been corrected to strictly validate widget identifiers against a whitelist of known safe values rather than accepting arbitrary file paths. For environments unable to upgrade immediately due to operational constraints, network segmentation should be enforced to restrict administrative access to the firewall management interface exclusively from trusted IP addresses using multi-factor authentication. Additionally, implementing strict file integrity monitoring on critical directories such as /tmp and ensuring that web server processes operate with minimal necessary privileges can reduce the blast radius of any successful exploitation attempt until a permanent fix is deployed.