CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.
CVE-2026-97730
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-97730
pfSense Plus
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
pfSense CE
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Netgate",
"modules": [
"webgui (Dashboard widget layout)"
],
"product": "pfSense Plus",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.07",
"versionType": "custom"
}
],
"platforms": [
"FreeBSD"
],
"programFiles": [
"index.php"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Netgate",
"modules": [
"webgui"
],
"product": "pfSense CE",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.9.0",
"versionType": "semver"
}
],
"platforms": [
"FreeBSD"
],
"programFiles": [
"index.php"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-97730
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #2424 · Revision 1
- Added to Heist Feed
- Publisher date