CVE-2026-97730In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacke…
Updated under an hour ago ()
Does this affect you?
It affects Netgate pfSense Plus and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.
- CVSS
- 8.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-24
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Netgate pfSense Plus netgate:pfsense_plus (from the name) | before 26.07 | CNA record |
Netgate pfSense CE netgate:pfsense_ce (from the name) | before 2.9.0 | CNA record |
References
- https://redmine.pfsense.org/issues/16947issue-tracking, technical-description
- https://docs.netgate.com/downloads/pfSense-SA-26_18.webgui.ascvendor-advisory
- https://redmine.pfsense.org/attachments/7146patch
- https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.htmlmitigation
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.