Executive brief
pfSense is a widely-used open-source firewall that protects networks using FreeBSD and a web-based management interface. An authenticated user with schedule-editing privileges can inject malicious JavaScript into firewall schedule descriptions. This script executes in the browser of any administrator viewing the firewall rules list, potentially allowing session hijacking or credential theft.
Technical details
The vulnerability is a stored Cross-Site Scripting (XSS) flaw in /firewall_rules.php caused by improper output encoding of schedule descriptions. Schedule descriptions are stored without HTML sanitization in /firewall_schedule_edit.php and later rendered into an HTML attribute value with only single-quote escaping, enabling a double-quote breakout attack. An authenticated user with the "Firewall: Schedules: Edit" privilege can craft a malicious description; the payload persists and executes whenever a user with "Firewall: Rules" privilege views the firewall rules list if the affected schedule is attached to a rule. The fix was applied in pfSense Plus 26.07 and later, and pfSense CE 2.9.0 and later.
Affected products
- Netgate pfSense Plus before 26.07
- Netgate pfSense CE before 2.9.0
Timeline
- 2026-08-13: disclosed: Security advisory published
- 2026-07-01: patched: Patches committed to pfSense Plus 26.07, pfSense Plus 26.10, and pfSense CE master (2.9.0)