CVE-2026-56126
MediumCVSS 5.4Summary
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.
Risk Assessment
The risk is persistent XSS affecting all users who visit the monitoring page, which could lead to session theft, account takeover, or other malicious actions.
Recommendation
It is recommended to upgrade pfSense to Plus 26.07 or CE 2.9.0 and to implement sanitization and encoding of input data for graph configuration parameters.
Other vulnerabilities in pfSense
See all- CVE-2026-56128Medium
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.
- CVE-2026-56127Medium
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.
- CVE-2026-67189Medium
pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records are incorporated without sanitization into AJAX responses and rendered as HTML. An attacker who controls a PTR record and generates sufficient traffic can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session and enabling account creation and arbitrary OS command execution.
- CVE-2024-57273Medium
An XSS vulnerability in the Automatic Configuration Backup (ACB) service of Netgate pfSense CE (prior to 2.8.0 beta) and corresponding Plus builds allows remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized 'reason' field and a derivable device key generated from the public SSH key.
Original NVD description (English source)
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.