CVE-2026-111222

Awaiting Analysis Awaiting Analysis - Queue

php.ini Injection in Netgate pfSense CE

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111222

EUVD

EUVD-2026-102334

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This is a php.ini injection vulnerability in Netgate pfSense CE through version 2.9.0. Authenticated users with General Setup privileges can inject malicious directives by manipulating the timezone setting. By embedding a quote and newline, attackers can add an auto_prepend_file directive pointing to /var/db/zoneinfo. This executes PHP code as root when php.ini is regenerated during boot or php-fpm restart.

Detection Guidance

Check pfSense logs for unauthorized timezone changes or php.ini modifications. Inspect /var/db/zoneinfo.rc.php_ini_setup for suspicious auto_prepend_file directives. Review system.php and rc.php_ini_setup for unexpected input handling. Monitor for unexpected php-fpm restarts or GUI crashes.

Impact Analysis

An attacker with authenticated access to the WebGUI could execute arbitrary PHP code with root privileges. This could lead to full system compromise, including unauthorized access, data theft, or rendering the GUI unusable until php.ini is repaired. The attack requires valid WebGUI session access.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, violating confidentiality and integrity requirements in GDPR and HIPAA. Full system access may result in exposure of sensitive data, non-compliance with data protection controls, and potential legal consequences.

Mitigation Strategies

Upgrade pfSense to a patched version. Disable General Setup privileges for non-admin users. Review timezone configurations for unauthorized changes. Monitor /var/db/zoneinfo.rc.php_ini_setup and php.ini for injected directives. Restrict write access to critical files.

Hi! I’m here to help you understand CVE-2026-111222. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70