-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-26_06.webgui Security Advisory pfSense Topic: Authenticated Command Execution via Proxy Settings Category: pfSense Base System Module: webgui Announced: 2026-08-13 Credits: @lujiefsi Affects: pfSense Plus software versions < 26.07 pfSense CE software versions <= 2.8.1 Corrected: 2026-06-17 18:12:06 UTC (pfSense Plus master, 26.10) 2026-06-17 19:49:14 UTC (pfSense Plus plus-RELENG_26_07, 26.07) 2026-06-17 18:12:06 UTC (pfSense CE master, 2.9.0) 0. Revision History v1.0 2026-08-13 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description A potential authenticated arbitrary command execution vulnerability was found that uses the proxy settings on system_advanced_misc.php, a component of the pfSense Plus and pfSense CE software GUI. The settings for proxy username (proxyuser) and proxy password (proxypass) on system_advanced_misc.php accept CR/LF characters, and other characters which are not valid for their content. The proxy credentials are added as shell variables in certain cases (e.g. in /etc/crontab) and specially-crafted payloads can allow adding arbitrary crontab entries which are executed by the cron daemon. This problem is present on pfSense Plus version 26.03.1, pfSense CE version 2.8.1, and earlier versions of both. III. Impact Due to a lack of validation on the proxy credentials, it is possible to execute arbitrary commands with specially-crafted values in the proxyuser and/or proxypass parameter in POST operations. The commands are not executed immediately in this case. A refresh of the cron content is necessary before the commands are executed. This can be achieved via reboot, saving the AutoConfigBackup settings, or manually via the Cron package. Users must be authenticated and have privileges to access system_advanced_misc.php to trigger the issue. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Limit access to the affected pages to trusted administrators only. V. Solution Users can upgrade to pfSense Plus software version 26.07 or later, or pfSense CE software versions after 2.8.1 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 26.03.1 and pfSense CE version 2.8.1 may apply the fix from the recommended patches list in the System Patches package after installing or updating the System Patches package. Users may also manually apply the relevant changes using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision - - ------------------------------------------------------------------------- plus/plus-master 647e5c290d81edeceb6c27fa35469b908c665daf plus/plus-RELENG_26_07 e3ef6149ef57ae203575695b62a76a702068a974 pfSense/master 647e5c290d81edeceb6c27fa35469b908c665daf - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmp+HosACgkQE7mH/ZIU +Np8Qg/9HdpOg80H0rc+Uv8nrhb87Cb65BkULpzfAjfxbfldTyZ6MzY5tCnvnR+d DI1GUpoXHicHmyjXhF/mZts0LGqgk/vvFRsQLwBljEgFDb7YOU5qFPy8JvwqZat2 5ELcyvISFlNQZijj0VGslmdh0aWvMqgMtMI+k5MA6SQMnNcI8I5q+dRBEA86mswM nIT969wvejoPcrXY+iXKjEEWNpVXp9dyKAJEsBnDXpHZ8b/1OpAnOmcUTYSAKfxR X184HNIl0RF+wxVIHnGEvsH19Gl5DnCGs0q5dRL7KlOPQCPXxBje941sowyXrYp8 QKFXAfo1wDb2afXWtsCQ1qQIXDESxKyniLNPhAWmvDU3avXCosXRtBV7dHFRw7BH y+j3StYnraNziQFtQ6XK0wqKL/tZwe048rrQ376QKzWP+Xrs8aStZ335/FrV8cif UkNlH0ligDZVZoJkyaX8BtBh+Z5uwUL7pOt4auRfsTOk29DDm6x4sH2DolzNUaHd VkYAkQ+C8cLexg+H8xgOjgeUhpbl4WnJjoBCkJLgEU6kXeBw9MNhxki51zoaHFmO 5px/KlgxEf70l5Cnfa8rlnSaO84gaBa3kzmPu1Gvmd8Q785xzAqcMlij5Jb7CLct aqXtsW+Ofvz9YTh11yw3CA2W3knzTiDAycBumU3aAqRxTft9NYI= =t51t -----END PGP SIGNATURE-----