Executive brief
pfSense is a network firewall used to protect corporate networks and manage traffic. A stored cross-site scripting (XSS) vulnerability in the Status Monitoring feature allows authenticated users with monitoring privileges to inject malicious JavaScript that executes when any user visits the page, potentially compromising session cookies or stealing sensitive information.
Technical details
A stored XSS vulnerability exists in status_monitoring.php where graph configuration parameters (graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, refresh-interval) are concatenated and written to the global pfSense XML configuration without sanitization. These unsanitized values are then echoed into a JavaScript string context on page render without proper encoding. The attack requires authentication with Status: Monitoring privilege and affects pfSense Plus before 26.07 and CE before 2.9.0. The payload persists in the global configuration and executes in the browser of every user visiting the Status Monitoring page. Patches are available in pfSense-Status_Monitoring v1.9 (Plus) and v1.8_10 (CE 2.8.1).
Affected products
- Netgate pfSense Plus before 26.07
- Netgate pfSense CE before 2.9.0
Timeline
- 2026-08-13: disclosed: Security advisory published
- 2026-06-30: patched: pfSense-Status_Monitoring v1.9 released for Plus 26.10 and CE 2.9.0
- 2026-07-01: patched: Patches released for Plus 26.07, 26.03.1, and CE 2.8.1