CVE-2026-97730

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://docs.netgate.com/downloads/pfSense-SA-26_18.webgui.asc
https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html
https://redmine.pfsense.org/attachments/7146
https://redmine.pfsense.org/issues/16947

Configurations

No configuration.

History

25 Sep 2026, 03:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-25 03:16

Updated : 2026-09-30 17:23

NVD link : CVE-2026-97730

Mitre link : CVE-2026-97730

CVE.ORG link : CVE-2026-97730

JSON object : View

Products Affected

No product.

CWE

CWE-24

Path Traversal: '../filedir'

{"id": "CVE-2026-97730", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-97730", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-26T22:41:31.034516Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Netgate", "modules": ["webgui (Dashboard widget layout)"], "product": "pfSense Plus", "versions": [{"status": "affected", "version": "0", "lessThan": "26.07", "versionType": "custom"}], "platforms": ["FreeBSD"], "programFiles": ["index.php"], "defaultStatus": "unaffected"}, {"vendor": "Netgate", "modules": ["webgui"], "product": "pfSense CE", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.0", "versionType": "semver"}], "platforms": ["FreeBSD"], "programFiles": ["index.php"], "defaultStatus": "unaffected"}]}], "published": "2026-09-25T03:16:59.533", "references": [{"url": "https://docs.netgate.com/downloads/pfSense-SA-26_18.webgui.asc", "source": "cve@mitre.org"}, {"url": "https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html", "source": "cve@mitre.org"}, {"url": "https://redmine.pfsense.org/attachments/7146", "source": "cve@mitre.org"}, {"url": "https://redmine.pfsense.org/issues/16947", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-24"}]}], "descriptions": [{"lang": "en", "value": "In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget."}], "lastModified": "2026-09-30T17:23:08.953", "sourceIdentifier": "cve@mitre.org"}