# CVE-2025-34176: Netgate pfSense Suricata directory traversal in suricata_ip_reputation.php

Source: https://junglewise.ai/threats/cve-2025-34176-netgate-pfsense-suricata-directory-traversal-in-suricata-ip  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-09. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-34176 · Severity: medium · CVSS 4.3 · Published 2025-09-09

A vulnerability exists in the Suricata security package for pfSense firewalls, which are used to monitor and protect network traffic. An authenticated user with specific permissions can use a flaw in the IP reputation management interface to determine if specific files exist on the underlying system. While the attacker cannot read the contents of these files, the ability to map out the file system can be used to gather intelligence for more complex subsequent attacks.

Technologies: [Netgate Pfsense Ce](https://junglewise.ai/threats/technologies/pfsense-ce), [Netgate Pfsense Plus](https://junglewise.ai/threats/technologies/pfsense-plus), [Netgate Suricata package for pfSense](https://junglewise.ai/threats/technologies/suricata-package-for-pfsense), [Pfsense](https://junglewise.ai/threats/technologies/pfsense). Vendors: [Netgate](https://junglewise.ai/threats/vendors/netgate), [Pfsense](https://junglewise.ai/threats/vendors/pfsense).

## Quick answers

**Is CVE-2025-34176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-34176 being exploited in the wild.

**How severe is CVE-2025-34176?** Medium severity, with a CVSS score of 4.3, published 9 September 2025.

**Which products and versions are affected?** Netgate Pfsense Ce up to (excluding) 2.8.0; Netgate Pfsense Plus up to (excluding) 25.07.1; Netgate Suricata package for pfSense <= 7.0.8_2.

**Is there a fix for CVE-2025-34176?** A patch was published on 2025-09-09. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-34176 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-34176?** Check whether you run Netgate Pfsense Ce, Netgate Pfsense Plus, Netgate Suricata package for pfSense or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability exists in the /suricata/suricata_ip_reputation.php component of the pfSense Suricata package. The 'iplist' parameter does not properly sanitize directory traversal sequences (e.g., ../) before using the value in a file existence check. While the application does not return the file contents, the response indicates whether a file exists at the specified path, allowing an authenticated attacker with 'WebCfg - Services: suricata package' permissions to enumerate files on the local filesystem. The issue is addressed in pfSense CE 2.8.0, pfSense Plus 25.07, and Suricata package version 7.0.8_3 or higher.

## Affected products

- Netgate pfSense CE up to (excluding) 2.8.0
- Netgate pfSense Plus up to (excluding) 25.07.1
- Netgate Suricata package for pfSense <= 7.0.8_2

## Timeline

- 2025-09-09: disclosed
- 2025-09-09: patched
- 2025-09-09: advisory

## References

- [https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4](https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4)
- [https://redmine.pfsense.org/issues/16414](https://redmine.pfsense.org/issues/16414)
- [https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-directory-traversal-information-disclosure](https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-directory-traversal-information-disclosure)

## Related threats

- [Netgate pfSense CE reflected XSS in firewall_rules.php](https://junglewise.ai/threats/cve-2026-111233-netgate-pfsense-ce-2-7-1-through-2-9-0-contains-a-reflected)
- [Netgate pfSense CE stored cross-site scripting in firewall rules](https://junglewise.ai/threats/cve-2026-111232-netgate-pfsense-ce-2-3-0-through-2-9-0-contains-a-stored-cross)
- [Netgate pfSense CE authorization bypass in config restore](https://junglewise.ai/threats/cve-2026-111231-netgate-pfsense-ce-through-2-9-0-contains-an-authorization)
- [Netgate pfSense CE local file read via Dynamic DNS](https://junglewise.ai/threats/cve-2026-111230-netgate-pfsense-ce-through-2-9-0-contains-a-local-file-read)
- [pfSense CE command injection in captive portal HA sync](https://junglewise.ai/threats/cve-2026-111229-pfsense-ce-2-7-0-through-2-9-0-contains-a-command-injection)