CVE-2026-97730
Received Received - Intake

Local File Inclusion in pfSense Dashboard Widget

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: MITRE

Description
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97730
EUVD
EUVD-2026-86509

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
netgate pfsense_plus to 26.07 (exc)
netgate pfsense_ce to 2.9.0 (exc)
netgate pfsense_ce to 2.8.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-24 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Local File Inclusion (LFI) vulnerability in Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0. An authenticated attacker with Dashboard modification privileges and file write access can exploit it by submitting a crafted widget sequence with a path traversal payload. This allows execution of arbitrary PHP code on the firewall system.

Detection Guidance

Check for unauthorized PHP files in web-accessible directories like /tmp/ or widget-related paths. Review Dashboard widget settings for suspicious sequences containing path traversal patterns (e.g., ../../../../../../../../../../../tmp/test). Inspect firewall logs for unusual file reads or executions in the web interface.

Impact Analysis

An attacker could gain full control over the pfSense firewall, execute arbitrary commands, steal sensitive data, or disrupt network operations. This requires the attacker to have administrative access to modify Dashboard settings and write files to the system.

Compliance Impact

This vulnerability allows an authenticated attacker with administrative access to execute arbitrary PHP code on the pfSense system. This could lead to unauthorized access to sensitive data, data exfiltration, or system compromise, which may violate compliance requirements under standards like GDPR (data protection) and HIPAA (healthcare data security) by exposing protected information or failing to maintain system integrity and confidentiality.

Mitigation Strategies

Upgrade pfSense Plus to version 26.07 or later and pfSense CE to version 2.9.0 or later. If upgrading is not immediately possible, apply patches via the System Patches package. Restrict Dashboard administrative access to trusted users only and audit widget configurations for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart