Description

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-03T15:17:30.793Z",
  "pubdate": "2026-09-03T15:17:30.793Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw identified in pfSense Plus and pfSense CE. The vulnerability arises from improper input validation and output encoding within the firewall rule configuration interface.\nAn authenticated user with 'Firewall: Rules: Edit' privileges can inject arbitrary JavaScript payloads into the 'descr' field of a firewall rule. This payload is persisted in the XML configuration file without undergoing proper HTML sanitization.\nThe malicious script is subsequently executed in the context of the browser belonging to any user who possesses 'Status: Logs: Firewall' privileges when they navigate to the 'status_logs_filter.php' page. This allows for session hijacking, unauthorized actions performed on behalf of the victim, or the exfiltration of sensitive configuration and session data.\nThe risk is significant for multi-administrator environments where lower-privileged administrators can compromise the accounts of those with higher visibility or administrative access. Exploitation requires authenticated access to the firewall configuration interface.",
  "technicalDetails": "The vulnerability resides in the interaction between '/firewall_rules_edit.php' and '/status_logs_filter.php'. When an authenticated user with appropriate firewall rule modification privileges inputs a payload into the 'descr' parameter, the system applies only minimal backslash-escaping before committing the input to the system's XML configuration file.\nThe root cause of this vulnerability is the failure to perform robust HTML sanitization or context-aware output encoding on the description field. Because the application trusts the stored input, the malicious JavaScript is rendered directly into the HTML document structure of the firewall logs page without sanitization.\nThe attack flow proceeds as follows: First, the attacker, possessing 'Firewall: Rules: Edit' privileges, crafts a malicious JavaScript payload designed to execute within the victim's browser session. Second, the attacker submits this payload via the 'descr' parameter in '/firewall_rules_edit.php'. Third, the firewall stores this string in the configuration XML. Finally, when an administrator with 'Status: Logs: Firewall' privileges accesses '/status_logs_filter.php', the browser interprets the unsanitized description field as executable script content, leading to arbitrary code execution within the security context of the victim's session.\nAffected products include pfSense Plus before version 26.07 and pfSense CE before version 2.9.0. The exploit is particularly dangerous because the script executes in the victim's session, effectively bypassing standard server-side authentication controls once the victim is already authenticated. The impact includes the potential for full account takeover, CSRF-based configuration changes, or unauthorized access to sensitive internal network monitoring data accessible to the compromised user session."
}