-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-26_08.webgui Security Advisory pfSense Topic: Stored XSS in browser.php used by diag_edit.php Category: pfSense Base System Module: webgui Announced: 2026-08-13 Credits: Touhid M Shaikh from NetSPI Affects: pfSense Plus software versions < 26.07 pfSense CE software versions <= 2.8.1 Corrected: 2026-06-29 17:27:18 UTC (pfSense Plus master, 26.10) 2026-06-29 17:28:26 UTC (pfSense Plus plus-RELENG_26_07, 26.07) 2026-06-29 17:27:04 UTC (pfSense CE master, 2.9.0) 0. Revision History v1.0 2026-08-13 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description A potential stored Cross-Site Scripting (XSS) vulnerability was identified in the file browser component of diag_edit.php at /usr/local/www/vendor/filebrowser/browser.php in its handling of directory names. Directory names are used in JavaScript with partial encoding that can be leveraged for XSS. This problem is present on pfSense Plus version 26.03.1, pfSense CE version 2.8.1, and earlier versions of both. III. Impact If an attacker with the ability to create arbitrary directories on the filesystem can create a directory with a specially-crafted name and then an administrator navigates to that directory when browsing files to edit, it could trigger an XSS. Arbitrary JavaScript could be executed in the user's browser. The user's session cookie or other information from the session may be compromised. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Limit access to functions which allow creating arbitrary directories on the filesystem. * Limit access to the affected pages to trusted administrators only. * Do not log into the firewall with the same browser used for non- administrative web browsing. V. Solution Users can upgrade to pfSense Plus software version 26.07 or later, or pfSense CE software versions after 2.8.1 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 26.03.1 and pfSense CE version 2.8.1 may apply the fix from the recommended patches list in the System Patches package after installing or updating the System Patches package. Users may also manually apply the relevant changes using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision - - ------------------------------------------------------------------------- plus/plus-master 345e04c9bb8221240020a79972c00db8507271ea plus/plus-RELENG_26_07 f58d417185b21a6b5e39cd17ac064b38548b1699 pfSense/master 345e04c9bb8221240020a79972c00db8507271ea - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmp+HpUACgkQE7mH/ZIU +Nqg5g//ZYtbM/3OfZpRcl9x1bvBuN1j7QvN1G3IGS4FDpXmThwVSBQB/YtYkhQl ERVGjqKqUK34JJ5ZloZDJMeXfwrVH+nepsaVYffjzuP0JCvq3zbYJmEC55xGqNa2 5dYAoQCl0KI7CZinGyVbLOELqPRrdQWtoDHukdq/S6EbX9J03HUq0sl0HJGaC2jA SMIMvuA0igWEw9363m5dHxe/Uur/tQQIB/vDUsxdR68fNuHT1oD9QW41Z91pWqnQ dU+T8ANJ/i8cWaZUG5y1JUeGa8leOxHNQQMJmadVXzwiSpF1Td7PBRE5WJZlDcrp e69YizekdIXJVPBKz9tUmbEoFsPo5PU5wPHGovhu7FtDIVLe1QopNXGIwkX0vIoC 0GmTbiWEsZdT8wDV55Hy9rg5PTXY4cVHCM48d7781en7fOTtqRXx7olav9e3tqj+ 2pFzJifBsKEz23APBasoAuUX/F+oCkgl2/t79O7qz+W+PsMuJhSbbIvHJY7iVk2I nWWi2Pmu9AQsQZFHZS14n/PlsqQqVebDbvrznxJVY37lO1a9rGYWvlha0QNHI4s0 1O5iZTcEQztXyTM+NgbcjJfewZalTPbaIPD5ciAN5UVb4CmZgrr9IJtScBvPb64k H466qi8Bf743vCtEKIQPupcwnbZFx5XYKOdmHEfQLcSqZSL/lCE= =Dfph -----END PGP SIGNATURE-----