CVE-2026-111222: Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add autoprependfile pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated pfSense CE user with General Setup privileges can exploit it. Exploitation requires the ability to submit a crafted timezone value containing a quote and newline.
What is the impact after successful exploitation?
The attacker can inject php.ini directives, including an auto_prepend_file directive referencing /var/db/zoneinfo. When php.ini is regenerated at boot or php-fpm is restarted, this can result in PHP code executing as root.
When does the injected configuration take effect?
The injected directive takes effect after php.ini is regenerated during a boot or after a php-fpm restart. The provided information does not identify an immediate mitigation other than preventing untrusted users from having General Setup privileges.
Which pfSense CE versions are affected?
The issue is reported in Netgate pfSense CE through version 2.9.0.