CVE-2026-111222
CVE-2026-111222 · Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.
CVSS 7.5 · Alta · EPSS 1,0%
- Publicación
- Actualización
Productos y versiones afectados
pfsense ce
- Versiones
- ≥ 0, ≤ 2.9.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/abraxas/pfsense-timezone-phpini
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/system.php#L288
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/system.inc#L2377-L2380
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/rc.php_ini_setup#L163-L166
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/rc.php_ini_setup#L220
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-php-ini-injection-via-timezone-setting
- https://nvd.nist.gov/vuln/detail/CVE-2026-111222