CVE-2026-111233
Pfsense: cross-site scripting
- Risk score
- 60/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 1.1%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges i…
- Affected
- Pfsense
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Pfsense: Amber, patch this week. Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell com…
The flaws
- CVE-2026-111233: Cross-site scripting (CVSS 6.1 · EPSS 1%)
- CVE-2026-111214: OS command injection (CVSS 7.2 · EPSS 11%)
- CVE-2026-111225: OS command injection (CVSS 8.8 · EPSS 6%)
- CVE-2026-111218: OS command injection (CVSS 7.2 · EPSS 9%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Pfsense
Where it stands
- Public proof of concept
Connects to
- Same weakness: Cross-site scripting (CWE-79). 400 other warnings in 30 days
- Same product: Earlier Pfsense warnings. 12 in the last 90 days
Why it is Yellow
- CVSS 6.1 medium
- On your watchlist: php
References
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/abraxas/pfsense-rules-if-xss
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L138-L146
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L391
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.1-through-2.9.0-reflected-xss-via-firewall-rules-php
Original description
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
Last activity 15 Oct 2026. Patch Forecast updates every hour.