CVE-2026-111218: Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so deletequeue() passes the unquoted value to dnctl via /bin/sh as root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated pfSense CE user who has Traffic Shaper Limiters privileges can exploit it. The provided data does not indicate that unauthenticated users or users without that privilege can reach the vulnerable functionality.
What access and actions are required for exploitation?
The attacker must edit a limiter and submit a malicious value in the hidden number field, then delete that limiter. During deletion, the unquoted value is passed to dnctl through /bin/sh with root privileges.
Which versions are affected?
The affected range is Netgate pfSense CE 2.7.0 through 2.9.0.
What is the impact of successful exploitation?
Successful exploitation allows execution of commands as root, with high impact to confidentiality, integrity, and availability.