Executive brief
pfSense is a network firewall that protects corporate and ISP networks. An authenticated firewall administrator can inject malicious JavaScript code into firewall rule descriptions, which then executes in the browsers of other administrators viewing firewall logs. This could lead to session hijacking, credential theft, or other attacks against administrative users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in status_logs_filter.php where firewall rule descriptions are rendered without HTML encoding in the firewall log table. The root cause is that descriptions are stored in the XML configuration with only backslash-escaping and no sanitization, then displayed unsanitized when inline rule descriptions are enabled in logs. An authenticated attacker with the "Firewall: Rules: Edit" privilege can inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The payload executes in the browser context of any user with "Status: Logs: Firewall" privilege who views the affected log entries, potentially compromising session tokens and sensitive data. Fixes are available in pfSense Plus 26.07+, pfSense CE 2.9.0+, or via System Patches on earlier versions.
Affected products
- Netgate pfSense Plus before 26.07
- Netgate pfSense CE before 2.9.0
Timeline
- 2026-08-13: disclosed
- 2026-07-01: patched: pfSense Plus 26.07 and 26.10, pfSense CE 2.9.0