CVE-2026-97730: Path Traversal
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated and have privileges to modify Dashboard settings. They must also be able to write an arbitrary PHP file to the pfSense firewall filesystem, such as under /tmp.
Is a default installation exposed to unauthenticated remote attack?
The described exploit does not allow unauthenticated use. It requires an authenticated account with Dashboard-setting privileges and an existing ability to write arbitrary files on the firewall.
What conditions are needed for code execution?
The attacker needs to place a PHP file on the firewall, then submit a crafted Dashboard widget sequence value containing a path traversal path to that file. When the Dashboard processes the sequence, it reads and executes the file as a widget.
Which releases are affected?
pfSense Plus releases before 26.07 and pfSense CE releases before 2.9.0 are affected.