# CVE-2025-34172: Netgate pfSense HAProxy reflected XSS in haproxy_stats.php

Source: https://junglewise.ai/threats/cve-2025-34172-netgate-pfsense-haproxy-reflected-xss-in-haproxy-stats-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-09. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-34172 · Severity: medium · CVSS 6.1 · Published 2025-09-09

A security vulnerability exists in the HAProxy package for pfSense, a popular open-source firewall and routing platform. The flaw allows an attacker to execute malicious scripts in the browser of an authenticated administrator if they are tricked into clicking a specially crafted link. This could lead to unauthorized actions being performed on the firewall or the theft of sensitive session information.

Technologies: [Netgate Pfsense Ce](https://junglewise.ai/threats/technologies/pfsense-ce), [Netgate Pfsense Plus](https://junglewise.ai/threats/technologies/pfsense-plus), [Pfsense](https://junglewise.ai/threats/technologies/pfsense). Vendors: [Netgate](https://junglewise.ai/threats/vendors/netgate), [Pfsense](https://junglewise.ai/threats/vendors/pfsense).

## Quick answers

**Is CVE-2025-34172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-34172 being exploited in the wild.

**How severe is CVE-2025-34172?** Medium severity, with a CVSS score of 6.1, published 9 September 2025.

**Which products and versions are affected?** Netgate HAProxy package for pfSense <= 0.63_10; Netgate Pfsense Ce up to (excluding) 2.8.0; Netgate Pfsense Plus up to (excluding) 25.07.0.

**Is there a fix for CVE-2025-34172?** A patch was published on 2025-09-09: Fixes merged into pfSense FreeBSD-ports repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-34172 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-34172?** Check whether you run Netgate HAProxy package for pfSense, Netgate Pfsense Ce, Netgate Pfsense Plus or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the HAProxy package for pfSense within the /usr/local/www/haproxy/haproxy_stats.php file. The root cause is the improper neutralization of the 'showsticktablecontent' HTTP GET parameter, which is displayed back to the user without adequate output encoding. An attacker can exploit this by inducing an authenticated user to visit a malicious URL, allowing the execution of arbitrary JavaScript in the context of the victim's session. The issue has been addressed in pfSense CE 2.8.0, pfSense Plus 25.07, and updated versions of the HAProxy package (post-0.63_10).

## Affected products

- Netgate pfSense CE up to (excluding) 2.8.0
- Netgate pfSense Plus up to (excluding) 25.07.0
- Netgate HAProxy package for pfSense <= 0.63_10

## Timeline

- 2025-09-09: advisory: Initial disclosure by VulnCheck and NVD publication
- 2025-09-09: patched: Fixes merged into pfSense FreeBSD-ports repository

## References

- [https://github.com/pfsense/FreeBSD-ports/commit/04d1328ab077830eb57a24bb7018c812b6358c64](https://github.com/pfsense/FreeBSD-ports/commit/04d1328ab077830eb57a24bb7018c812b6358c64)
- [https://redmine.pfsense.org/issues/16411](https://redmine.pfsense.org/issues/16411)
- [https://www.vulncheck.com/advisories/netgate-pf-sense-ce-ha-proxy-reflected-xss](https://www.vulncheck.com/advisories/netgate-pf-sense-ce-ha-proxy-reflected-xss)

## Related threats

- [Netgate pfSense CE reflected XSS in firewall_rules.php](https://junglewise.ai/threats/cve-2026-111233-netgate-pfsense-ce-2-7-1-through-2-9-0-contains-a-reflected)
- [Netgate pfSense CE stored cross-site scripting in firewall rules](https://junglewise.ai/threats/cve-2026-111232-netgate-pfsense-ce-2-3-0-through-2-9-0-contains-a-stored-cross)
- [Netgate pfSense CE authorization bypass in config restore](https://junglewise.ai/threats/cve-2026-111231-netgate-pfsense-ce-through-2-9-0-contains-an-authorization)
- [Netgate pfSense CE local file read via Dynamic DNS](https://junglewise.ai/threats/cve-2026-111230-netgate-pfsense-ce-through-2-9-0-contains-a-local-file-read)
- [pfSense CE command injection in captive portal HA sync](https://junglewise.ai/threats/cve-2026-111229-pfsense-ce-2-7-0-through-2-9-0-contains-a-command-injection)