CVE-2026-111232
CVE-2026-111232 · Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
CVSS 4.8 · Medium · EPSS 1.0%
- Published
- Updated
Affected products and versions
pfsense ce
- Versions
- ≥ 2.3.0, ≤ 2.9.0: Affected (semver)
No fix published
Original sources
- https://github.com/abraxas/pfsense-separator-color-xss
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/filter.inc#L6238-L6252
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L236-L245
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.3.0-through-2.9.0-stored-xss-via-separator-color
- https://nvd.nist.gov/vuln/detail/CVE-2026-111232