CVE-2026-111230: Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Dynamic DNS client privilege can exploit it. The attacker does not need user interaction, but must be able to configure a Dynamic DNS entry.
What information can be exposed?
The attacker can cause files read as root to be written to the system log. Examples identified include /conf/config.xml and /etc/master.passwd.
How is the issue triggered?
The attacker sets a custom Dynamic DNS Update URL using the file:// scheme and configures a non-matching Result Match string. This causes _checkStatus() to log the referenced file's contents.
What can be done if updating is not immediately possible?
Restrict the Dynamic DNS client privilege to fully trusted administrators and review Dynamic DNS configurations for custom file:// Update URLs or suspicious Result Match values. Review system logs for unexpected sensitive file contents.