-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-26_15.webgui Security Advisory pfSense Topic: Stored XSS via PPP instance Provider and Plan fields Category: pfSense Base System Module: webgui Announced: 2026-08-13 Credits: @lujiefsi Affects: pfSense Plus software versions < 26.07 pfSense CE software versions <= 2.8.1 Corrected: 2026-07-10 18:25:06 UTC (pfSense Plus master, 26.10) 2026-07-10 18:34:08 UTC (pfSense Plus plus-RELENG_26_07, 26.07) 2026-07-10 18:25:06 UTC (pfSense CE master, 2.9.0) 0. Revision History v1.0 2026-08-13 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description A potential stored Cross-Site Scripting (XSS) vulnerability was identified in interfaces_ppps_edit.php when creating or editing a PPP interface instance. The page does not validate the content of the provider and providerplan fields and then uses the values of those fields in JavaScript without encoding. This problem is present on pfSense Plus version 26.03.1, pfSense CE version 2.8.1, and earlier versions of both. III. Impact If an attacker with the ability to create or edit PPP interface instances on interfaces_ppps_edit.php manipulates the form and stores specially-crafted values in the provider and/or providerplan fields, it could trigger an XSS when editing that PPP interface instance. This only affects entries on interfaces_ppps_edit.php with the type set to ppp. Arbitrary JavaScript could be executed in the user's browser. The user's session cookie or other information from the session may be compromised. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Limit access to the affected pages to trusted administrators only. * Do not log into the firewall with the same browser used for non- administrative web browsing. V. Solution Users can upgrade to pfSense Plus software version 26.07 or later, or pfSense CE software versions after 2.8.1 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 26.03.1 and pfSense CE version 2.8.1 may apply the fix from the recommended patches list in the System Patches package after installing or updating the System Patches package. Users may also manually apply the relevant changes using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision - - ------------------------------------------------------------------------- plus/plus-master fa333276c5ae97e27974e3b33d17da5919b4bdda plus/plus-RELENG_26_07 efed73557ed1546657f95487c514b418bf130c52 pfSense/master fa333276c5ae97e27974e3b33d17da5919b4bdda - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmp+HrIACgkQE7mH/ZIU +NpAMhAAzysFEJcSYHmC0Rq0mUVDDItOQl0+Yek8l9yG0Zuwpwi9woOJp4h6y8n1 HJeLjNrauNkx6wifsPRrmhVyTzZii2Mn4ldVz/vjCId8a1kQbumlLv8N7Z8vzEEg PkHXsC75xICrClmM0I3xIdiqd0pGxNSBgcdCLaCeHRQXb972XQekxEB7Se2/eEX0 pq/1Z+ie5Pa9Hz/mNee8rCjYoxYgTW5YnmiCkKhzgztyY45Dv4OwtEK7V4RlM21d B3TYvyCpFLDYH+e6SOk5Ps6aM8tNaLS29BLp79JkTNR9CtywNbN9JU3UL3v2koj/ uu0t2AOfopJEq+H04cNw0QHdLOI5bXTI4TCvqk0KOsPMSdV+P/XYg6qJ7d5c2CAk JwVb4kP2fCK3u0rGRLUlgXqPNbTRVsEokj/Uk7DI3ppu2HYi18keV1BxkkdJvsyK n5DHzD5qV86zOZY97/KXp3PO9YtIyISNqfMJUb6TR6jZdjBg01ev7zyGDdc0VhKl /zwocUcT9+VPqGEDYuuuEf1xLbXa/JO+BDo73Cz18AtRPlQ/PaQD2w8IpaOkqouu 1HqBxwToOZLu7AK6etw8QMJ13voqKHROuYukUxNh/i75J6Dn/chNmQA3t8YAXtfC /zaBtjevdgqeQpW2da799VjjtRW20mlxb1UGf663q8jbMMBRLPY= =E3X8 -----END PGP SIGNATURE-----