CVE-2026-56127
Received Received - Intake

Authenticated JavaScript Injection in pfSense Firewall Logs

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-56127
EUVD
EUVD-2026-70496

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
netgate pfsense_plus to 26.07 (exc)
netgate pfsense_ce to 2.9.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in pfSense. An authenticated user with Firewall: Rules: Edit privileges can inject malicious JavaScript into firewall rule descriptions via the descr parameter. The injected script is stored in the pfSense XML configuration without proper HTML sanitization and executes in the browser of any user viewing the affected log entries in the firewall log table.

Detection Guidance

Check pfSense firewall rule descriptions for suspicious JavaScript or HTML content in /status_logs_filter.php. Look for entries with unexpected scripts in the description field. Review user accounts with Firewall: Rules: Edit privileges for unauthorized modifications.

Impact Analysis

An attacker could steal session cookies or sensitive information from users viewing firewall logs. This may lead to unauthorized access to the pfSense interface or other systems. The impact depends on the privileges of the logged-in users viewing the logs.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must address this flaw to maintain compliance with these regulations.

Mitigation Strategies

Upgrade pfSense Plus to 26.07 or later and pfSense CE to 2.9.0 or later. Disable inline rule descriptions in logs as a temporary workaround. Restrict Firewall: Rules: Edit privileges to trusted users only. Avoid administrative logins from untrusted browsers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56127. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart