CVE-2026-56126: pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pfSense Plus / pfSense CE (status_monitoring.php)to a version that resolves this vulnerability.Fixed in 26.07
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the payload?
An authenticated user with the Status: Monitoring privilege can store a malicious payload. It executes in the browser of every user who subsequently visits the Status: Monitoring page.
Does exploitation require administrator access or a special deployment configuration?
The required access identified is the Status: Monitoring privilege; administrator access is not stated as a requirement. The vulnerable graph configuration is stored in the global pfSense XML configuration, so the stored payload is not limited to the account that created it.
How can I determine whether a system may be affected?
pfSense Plus releases before 26.07 and pfSense CE releases before 2.9.0 are affected. Review the Status: Monitoring graph configuration for unexpected values in parameters such as graph-left, graph-right, time-period, resolution, date and time fields, graph-type, invert, and refresh-interval.