CVE-2026-111232: Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that displayseparator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated pfSense CE user must have either Firewall: Rules or NAT: Port Forward privileges. Exploitation also requires an administrator to view a page that renders the malicious separator.
What is the practical impact of a successful exploit?
The injected script runs in an administrator's browser and can perform WebGUI actions using that administrator's privileges. The affected field is the separator color value submitted as separator[] color.
Which installations are affected?
The reported affected range is Netgate pfSense CE 2.3.0 through 2.9.0. The provided information does not state whether any particular default configuration enables or prevents exploitation.