CVE-2026-38961

Netgate pfSense version 26.03.1-RELEASE is vulnerable to Cross Site Scripting (XSS), allowing an attacker to execute arbitrary code in the victim's browser context through the pfBlockerNG package.

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.

A Cross-Site Scripting (XSS) vulnerability in Netgate pfSense Plus software versions <= 26.03 and pfSense CE software versions <= 2.8.1 exists in the captive_portal_status.widget.php file. A remote attacker can exploit this to execute arbitrary code in the victim's browser.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records are incorporated without sanitization into AJAX responses and rendered as HTML. An attacker who controls a PTR record and generates sufficient traffic can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session and enabling account creation and arbitrary OS command execution.

An XSS vulnerability in the Automatic Configuration Backup (ACB) service of Netgate pfSense CE (prior to 2.8.0 beta) and corresponding Plus builds allows remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized 'reason' field and a derivable device key generated from the public SSH key.