-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-26_13.webgui Security Advisory pfSense Topic: Stored XSS in DHCPv6 Pool Descriptions Category: pfSense Base System Module: webgui Announced: 2026-08-13 Credits: @lujiefsi Affects: pfSense Plus software versions < 26.07 pfSense CE software versions <= 2.8.1 Corrected: 2026-07-10 16:01:42 UTC (pfSense Plus master, 26.10) 2026-07-10 16:06:53 UTC (pfSense Plus plus-RELENG_26_07, 26.07) 2026-07-10 16:01:42 UTC (pfSense CE master, 2.9.0) 0. Revision History v1.0 2026-08-13 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description A potential stored Cross-Site Scripting (XSS) vulnerability was identified in services_dhcpv6.php when adding or editing address pools while using the Kea DHCP backend. When adding or editing a DHCPv4 pool, the services_dhcpv6.php page prints the descr field of existing pools without encoding. This problem is present on pfSense Plus version 26.03.1, pfSense CE version 2.8.1, and earlier versions of both. This only affects systems using the Kea DHCP backend, the ISC DHCP backend is not affected. III. Impact If the system is configured to use the Kea DHCP backend and an attacker with the ability to create or edit DHCP address pools saves a specially-crafted payload in a pool description, it could trigger an XSS when adding or editing a DHCPv4 pool on services_dhcpv6.php. Arbitrary JavaScript could be executed in the user's browser. The user's session cookie or other information from the session may be compromised. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Switch to the ISC DHCP backend until the fix is applied * Limit access to the affected pages to trusted administrators only. * Do not log into the firewall with the same browser used for non- administrative web browsing. V. Solution Users can upgrade to pfSense Plus software version 26.07 or later, or pfSense CE software versions after 2.8.1 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 26.03.1 and pfSense CE version 2.8.1 may apply the fix from the recommended patches list in the System Patches package after installing or updating the System Patches package. Users may also manually apply the relevant changes using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision - - ------------------------------------------------------------------------- plus/plus-master 7f8bf8ea51a8303020b5ecf44f6fe9902b12f73b plus/plus-RELENG_26_07 9aecdd9e5d79b9e49b68b4f3ea393becd3e801d1 pfSense/master 7f8bf8ea51a8303020b5ecf44f6fe9902b12f73b - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmp+HqkACgkQE7mH/ZIU +NrvRBAAlwaowbRh5PLskwUt+XaOxKm4G+xFD5t1fHdGnlEQ0F8ZbSSsmZC4wXRj rQsvIIU0ynm0q0qt9kNTg/85QdS7Vi89mhZTuo9uoc34nyyOM5GrAn0zFt7Eov2c UU0G56a1+jR0lD2jIphaxnR0VzRskAZrvT3VRM5dr+qXsiNsC+35w95HRNKQtofv k2cBPUFKEN8jPj3Q/8bjDZ2hKGt8ND3KArg01K2OgWOd+BupPq9N6aEnYTwM89L/ KufTUr1F7yuquj9YA1DSTJjZmdhaA+bCS71ihAzI566gvZSoN74vmDO+pAtf1kE9 lP1ykiT7qzbl9ylRbyRri6/XpcR0vRold99d9XWKOm49KoXq9UU6my33wjrde7f1 mRiXFjJgO37SQyimO0PHsFVqFazQpKTWIDF1f2HGli9Z0GxqmE9seBoLszNduFwt EFmeIlqSeg/gU7g4sZacljNScEbXrs+YW6mFEwvmWtPGIIFG4n1gfVkaMMtgzrKV JtSstNrWd8Fd8HhWARhb7qHEr2fboewIHrpu25BUURkVAxUfdvsxas77VZUttFOp rKB8rn1RN/sK5ShgOlmPB9RxmR6SUIxy21AQ9UbG2twaxJhvKPGTI+bmOqAJx8a0 47mTh5yKwHCpltFXP4vzWKI6hv/YJBeefI09tMrIgDw2C4D4Vh8= =Rme/ -----END PGP SIGNATURE-----