-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-26_18.webgui Security Advisory pfSense Topic: Local File Inclusion (LFI) in Dashboard widget data Category: pfSense Base System Module: webgui Announced: 2026-08-13 Credits: Touhid M Shaikh from NetSPI Affects: pfSense Plus software versions < 26.07 pfSense CE software versions <= 2.8.1 Corrected: 2026-07-14 17:29:23 UTC (pfSense Plus master, 26.10) 2026-07-14 17:36:56 UTC (pfSense Plus plus-RELENG_26_07, 26.07) 2026-07-14 17:29:23 UTC (pfSense CE master, 2.9.0) 0. Revision History v1.0 2026-08-13 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description A potential Local File Include (LFI) vulnerability was discovered in the handling of Dashboard widget sequence data. The Dashboard widget layout data (sequence) is not validated when making changes to widgets or when displaying widget data. This problem is present on pfSense Plus version 26.03.1, pfSense CE version 2.8.1, and earlier versions of both. III. Impact An attacker with sufficient access to change settings on the Dashboard (index.php) and the ability to write arbitrary files on the firewall could run arbitrary PHP code. The attacker can submit a specially-crafted set of widget sequence data containing a path traversal to the location of their arbitrary file which the Dashboard will follow and display as a widget, including executing PHP code in the file. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Limit access to the affected pages to trusted administrators only. V. Solution Users can upgrade to pfSense Plus software version 26.07 or later, or pfSense CE software versions after 2.8.1 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 26.03.1 and pfSense CE version 2.8.1 may apply the fix from the recommended patches list in the System Patches package after installing or updating the System Patches package. Users may also manually apply the relevant changes using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision - - ------------------------------------------------------------------------- plus/plus-master 61e736e10e6f6542ce7a7c7bed37fb333c09467f 8fa0daeafdfbbcf9629c51dfc74c55bdab83554d plus/plus-RELENG_26_07 c30c57b845f99c0f14a44bdb37681fce939cf056 ecc9b4f3a2ccbbce3a956f061d784490e6fbf465 pfSense/master 61e736e10e6f6542ce7a7c7bed37fb333c09467f 8fa0daeafdfbbcf9629c51dfc74c55bdab83554d - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmp+Hr4ACgkQE7mH/ZIU +NoHTRAAu1fFbZv6rDUQQgn4PMNHHHlZD0I/RhplEhvkERggaz/z1fwMpWyrDWgK qE6wsxLUBorvx47I3ueMJyrFkoBlb8PCX0E+KGK2KC3xlqsDDBqMkKeOAwnz/Zgl ac/yv/s2v52JUGLFs36JrMacZjtTNpzYOPx6fBhX2wjj9UKnE9j123c+MC1VIPUp Liiic1alvuEr2h57kgr1ifCbPkiWWiTygfsZs/WhnXJsrSuApP7paZFgfQ+cnSex uzoM6K4pq+SoH16r4gzjZJ7KKxSQXQSTn8HFG/bQgCBHew42I9NUOx6RzdsWQg6S 61bjNWihlUbMVQjmquxjMEmIwVOxvmkBoRG62+UhWdnj+NxJpqIzL4/pPYoKnqIQ Vgczm/OfgmmaogxyJ0OJsKbO3jyUiXCf2000VN+JvBfVOaQcF9x1guHElPthT1eb pdsqxXjDcnRvPuNPX2WNeKVa2tbbdav3Tg5TM7bmMkj7dADgEZFAKjzmApA+TOyO PLBZ7hCw5v5ZUVbzXKiDCyFieBFXK1rlNfSi1CCD6CXjJLg4tTe0VjJSyQtGQbIn v+gtN1xwu3spLrtNta+CY9cfRTLlF2zuhcKnGjrT/D7hTwI9dS2/8cbFzUeKiIs8 2Jf1uSzCnZvqfjEXxyRhVvqSKZTEnSZ6Q8Vbj9VK7t9PHNaISuQ= =UAWO -----END PGP SIGNATURE-----