CVE-2026-97730: high-severity vulnerability in Netgate pfSense Plus
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 1.0%
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Related CVEs — Netgate pfSense Plus
In the same product, most dangerous first.
CVE-2025-34175MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingEPSS 24.0%CVE-2025-34176MEDIUMNetgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information DisclosureEPSS 20.5%CVE-2025-34174MEDIUMNetgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site ScriptingEPSS 17.3%CVE-2026-111214HIGHNetgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.phpEPSS 10.8%CVE-2026-111218HIGHNetgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper LimitersEPSS 8.6%CVE-2026-111217HIGHNetgate pfSense CE through 2.9.0 OS Command Injection via CARP VHIDEPSS 7.0%