CVE-2026-56128: pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewallrules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Authenticated users with the Firewall: Schedules: Edit privilege can store the malicious schedule description. The payload executes when a user with the Firewall: Rules privilege views the rules list and the affected schedule is attached to a rule.
What conditions are required for exploitation?
An attacker needs an authenticated account with Firewall: Schedules: Edit permission and must be able to modify the descr parameter for a schedule. A target user must then view the firewall rules list containing that schedule.
How can I determine whether a schedule may be malicious?
Review schedule descriptions, particularly schedules attached to firewall rules, for unexpected HTML or JavaScript-like content. The vulnerable handling occurs when stored description content is rendered in the firewall rules list.
What can be done before upgrading?
Restrict the Firewall: Schedules: Edit privilege to trusted administrators and review or remove suspicious schedule descriptions. Users with Firewall: Rules access should avoid viewing rules associated with untrusted or unreviewed schedules until affected descriptions are remediated.