Description

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-25T03:16:59.533Z",
  "pubdate": "2026-09-25T03:16:59.533Z",
  "executiveSummary": "A Local File Inclusion (LFI) vulnerability exists in the Dashboard component of Netgate pfSense Plus and pfSense CE, allowing authenticated attackers to achieve Remote Code Execution (RCE).\nThe vulnerability resides in the insecure handling of widget sequence data within index.php, where improper input sanitization permits path traversal attacks.\nBy manipulating the widget sequence configuration, an attacker can force the system to include and execute arbitrary PHP files placed on the local filesystem.\nAffected products include Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0.\nExploitation requires authenticated access with sufficient privileges to modify Dashboard settings and the capability to write files to the system, such as in /tmp/.\nSuccessful exploitation results in full server-side code execution, enabling the attacker to compromise the firewall system, escalate privileges, or intercept sensitive network traffic.\nThis represents a high-risk security flaw as it grants attackers control over the appliance integrity.",
  "technicalDetails": "The vulnerability is located in index.php, which is responsible for rendering the pfSense Dashboard. The system processes a user-supplied 'widget sequence' parameter that dictates the order and loading of individual dashboard widgets.\nThe root cause is an improper validation of the input provided for these widget identifiers. The application fails to sanitize path traversal sequences, allowing an attacker to reference files outside of the intended directory structure.\nAn attacker who has gained authenticated access and possesses the privileges to modify the Dashboard configuration can inject a malicious path into the widget sequence field. For example, by providing a payload such as '../../../../../../../../../../../../tmp/test', the attacker manipulates the internal logic responsible for loading widget files.\nWhen the Dashboard attempts to initialize the requested widget based on this sequence, the include mechanism processes the path traversal string. If the attacker has successfully uploaded a PHP file—for instance, via other system functions or temporary file creation mechanisms—to a location like /tmp/test.widget.php, the application treats this file as a legitimate widget.\nBecause the application executes the included file within the context of the web server process, the embedded PHP code is interpreted and executed immediately.\nThe exploit flow follows these steps: 1) The attacker uploads a malicious PHP script to a writable directory on the pfSense system, such as /tmp/. 2) The attacker interacts with the Dashboard settings, modifying the widget sequence configuration to include the path traversal payload pointing to the previously uploaded malicious file. 3) Upon saving or refreshing the dashboard, index.php attempts to include the specified widget. 4) The application resolves the path traversal, points the file include to the attacker-controlled script, and executes the code.\nThis vulnerability is restricted to authenticated users with dashboard modification rights. However, once triggered, it results in arbitrary code execution, which effectively grants the attacker control over the underlying operating system. The scope of impact is total, as the attacker can leverage the execution context of the web server to access internal system files, modify configuration data, or deploy persistent backdoors within the pfSense environment."
}