CVE-2026-111233: Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewallrules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
pfSense CE installations running versions 2.7.1 through 2.9.0 are exposed when the non-default Require Firewall Interface option is enabled. Exploitation targets WebGUI users who have firewall rules privileges.
What does an attacker need to exploit it?
An attacker does not need prior privileges, but must persuade a user with firewall rules privileges to open a crafted GET link. The crafted request injects script through the unencoded if parameter in firewall_rules.php.
Are default configurations affected?
The described attack path requires the non-default Require Firewall Interface option to be enabled. The provided information does not indicate that the default configuration is affected.
What is the impact if exploitation succeeds?
Injected script executes in the pfSense WebGUI with the privileges of the user who opened the crafted link. The reported impact includes limited confidentiality and integrity effects, with no availability impact.