Executive brief
A security vulnerability exists in the HAProxy package for pfSense, a popular open-source firewall and routing platform. The flaw allows an attacker to execute malicious scripts in the browser of an authenticated administrator if they are tricked into clicking a specially crafted link. This could lead to unauthorized actions being performed on the firewall or the theft of sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the HAProxy package for pfSense within the /usr/local/www/haproxy/haproxy_stats.php file. The root cause is the improper neutralization of the 'showsticktablecontent' HTTP GET parameter, which is displayed back to the user without adequate output encoding. An attacker can exploit this by inducing an authenticated user to visit a malicious URL, allowing the execution of arbitrary JavaScript in the context of the victim's session. The issue has been addressed in pfSense CE 2.8.0, pfSense Plus 25.07, and updated versions of the HAProxy package (post-0.63_10).
Affected products
- Netgate pfSense CE up to (excluding) 2.8.0
- Netgate pfSense Plus up to (excluding) 25.07.0
- Netgate HAProxy package for pfSense <= 0.63_10
Timeline
- 2025-09-09: advisory: Initial disclosure by VulnCheck and NVD publication
- 2025-09-09: patched: Fixes merged into pfSense FreeBSD-ports repository