CVE-2026-56127: pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /statuslogsfilter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pfSense Plusto a version that resolves this vulnerability.Fixed in 26.07 - Upgrade
Upgrade
pfSense CEto a version that resolves this vulnerability.Fixed in 2.9.0 - Compensating control
Until upgrading, restrict access to pfSense Status: Logs: Firewall and ensure only trusted users with the Status: Logs: Firewall privilege can view firewall log table entries (e.g., limit the privilege via authentication/role controls).
- Compensating control
Until upgrading, restrict access to the Firewall: Rules: Edit privilege so only trusted administrators can edit firewall rules (limit who can access firewall_rules_edit.php/descr injection).
Event History
Frequently Asked Questions
Which users can inject the malicious content, and which users are at risk of executing it?
An authenticated user needs the Firewall: Rules: Edit privilege to inject JavaScript through a firewall rule description. The script executes when a user with the Status: Logs: Firewall privilege views affected entries in the firewall log table.
What application behavior makes this issue persistent?
The supplied rule description is stored in the pfSense XML configuration with only backslash escaping and without HTML sanitization. It is later rendered in /status_logs_filter.php without encoding, allowing the stored payload to execute in a viewer's browser.
Which releases are affected?
pfSense Plus releases before 26.07 and pfSense CE releases before 2.9.0 are affected.