-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-26_17.webgui Security Advisory pfSense Topic: Stored XSS via URL Table Ports Alias content Category: pfSense Base System Module: webgui Announced: 2026-08-13 Credits: @lujiefsi Affects: pfSense Plus software versions < 26.07 pfSense CE software versions <= 2.8.1 Corrected: 2026-07-10 19:13:20 UTC (pfSense Plus master, 26.10) 2026-07-10 19:39:06 UTC (pfSense Plus plus-RELENG_26_07, 26.07) 2026-07-10 19:13:20 UTC (pfSense CE master, 2.9.0) 0. Revision History v1.0 2026-08-13 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description A potential stored Cross-Site Scripting (XSS) vulnerability was identified in the handling of URL Table Ports Alias content when the content was displayed in tooltips on rules pages such as firewall rules (firewall_rules.php) or NAT rules (firewall_nat.php) for entries using affected aliases. Comments imported with URL Table Aliases for Port content are retained and the helper function alias_info_popup() which renders the content without encoding. This problem is present on pfSense Plus version 26.03.1, pfSense CE version 2.8.1, and earlier versions of both. III. Impact If an attacker can create an alias with a type of "URL Table (Ports)" and point that alias to a URL containing malicious content, comments in that content will be fetched and stored along with the port data in the file. The attacker must also have the ability to create a firewall or NAT rule which utilizes that alias. With the alias in use on a rule, it could trigger an XSS when viewing the list of rules. Arbitrary JavaScript could be executed in the user's browser. The user's session cookie or other information from the session may be compromised. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Limit access to the affected pages to trusted administrators only. * Do not log into the firewall with the same browser used for non- administrative web browsing. V. Solution Users can upgrade to pfSense Plus software version 26.07 or later, or pfSense CE software versions after 2.8.1 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 26.03.1 and pfSense CE version 2.8.1 may apply the fix from the recommended patches list in the System Patches package after installing or updating the System Patches package. Users may also manually apply the relevant changes using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision - - ------------------------------------------------------------------------- plus/plus-master d6fb77d7bee97136433a155bf4987dca415770e8 plus/plus-RELENG_26_07 fdd1817c07e2e8ad85274ed16cff33e0a37326c9 pfSense/master d6fb77d7bee97136433a155bf4987dca415770e8 - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmp+HroACgkQE7mH/ZIU +Nr+/xAAmWgP17RDLpz7YfvIycui/pZ4mkOEcF5OfyjnMYh5haKnul0K6OspZA3x uaCxpiJaz7gKwzXO2MHas4Q+YodCvx81oSmgMg/EocGE8m6CgVha1IQdcO7dL4TI BpYLh+X98Me9Tf1kDJbKsQbqLP+sEVOrjkYOpT1lK2X840XWlaQjsizyemM87Zd6 P9GAFgYFggWV60b0nyEA71aNWUu5wTxwhKiFTzrQgghlQpcYLtB3eJWNJxtPBmgm X3DIHujYCEN1rlT7QBtwuhdIw2MA6BPJVBqTWrQCaB7v8gHIORdJULbAollDYJfK /pRljGAhuUtwabJrh6wbqmJQczj6VccSkm1yc9Z/CH7+rWUoiQzNkoznAWVOGawc UUEqvB69z1qs9i/N7LKQVM2vNY7U1gZCjlkwxyR5T+6IEu2JMRL5FgbxY4bDm8Bc Joe6GSLEqbqQSTJM0pEVke26w6gGNjCKZTIRQyjAD+UxpZj1sBqpFW6cIYefLUki apOLeOwAV7g+Pwjfr4+Dswt2WnAdcq8G3QJD5PWDwV7Bb3mu0j7OAvGWBZrrwQp7 loBsG8NfLJchUcdQpW9DYvyP+dn8rlrsKD6sihsiN+ur3lPK8lbuV+eN/VduM885 NqLyxCX7J1yR/6gTbeA+t6k2Cd79q+s1DCFEkTZ3xX1tDAQfvhY= =bSS7 -----END PGP SIGNATURE-----