CVE-2025-12490: pfSense Suricata Path Traversal RCE Flaw

CVE-2025-12490 Overview

CVE-2025-12490 is a path traversal vulnerability [CWE-22] in the Suricata package for Netgate pfSense CE. The flaw lets authenticated remote attackers create arbitrary files on affected installations by supplying a crafted path that the package fails to validate before performing file operations. Successful exploitation results in file creation in the context of root, enabling remote code execution on the firewall appliance. The issue was reported through the Zero Day Initiative as ZDI-CAN-28085 and disclosed in advisory ZDI-25-979.

Critical Impact
Authenticated attackers can write arbitrary files as root on pfSense firewalls running the vulnerable Suricata package, leading to full remote code execution and compromise of perimeter security infrastructure.

Affected Products

Netgate pfSense CE with the pfSense-pkg-snort / Suricata package installed
pfSense-pkg-snort versions prior to 4.1.7 revision 1
FreeBSD ports tree builds of the pfSense Snort/Suricata package

Discovery Timeline

2025-11-06 - CVE-2025-12490 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12490

Vulnerability Analysis

The vulnerability resides in the Suricata package shipped with pfSense CE, which exposes web-based rule management functionality. The affected code path accepts a user-supplied ruleset identifier and uses it directly in file system operations without normalizing or constraining the path. An authenticated attacker with access to the Suricata package interface can supply a value containing directory traversal sequences such as ../ to escape the intended rules directory.

Because the pfSense web UI executes with elevated privileges, file operations performed by the vulnerable handler run as root. This grants the attacker the ability to write attacker-controlled content to arbitrary file system locations, including PHP files within the web root, cron job directories, or startup scripts. The classification under [CWE-22] reflects improper limitation of a pathname to a restricted directory.

Root Cause

The root cause is the absence of basename() or equivalent sanitization on the $currentruleset variable before it is used to construct file paths in snort_rules.php. The vendor patch adds an explicit call to basename($currentruleset) to strip any directory components from the user-supplied value.

Attack Vector

Exploitation requires authentication to the pfSense web interface but no user interaction. An attacker submits a request to the Suricata rules management endpoint with a ruleset parameter containing traversal sequences. The application resolves the manipulated path and creates or overwrites files at the attacker-chosen location with root privileges, which can be chained into command execution by dropping a PHP webshell or modifying a periodically executed script.

php

 else
 	$currentruleset = $categories[array_key_first($categories)];
 
+$currentruleset = basename($currentruleset)
+
 // One last sanity check -- if the rules directory is empty, default to loading custom rules
 $tmp = glob("{$snortdir}/rules/*.rules");
 if (empty($tmp))

Source: GitHub Commit for FreeBSD Ports — the patch inserts basename() on $currentruleset to strip any path components before the value is used in subsequent file operations.

Detection Methods for CVE-2025-12490

Indicators of Compromise

Unexpected files appearing under /usr/local/www/ or within Suricata rules directories on pfSense hosts
Newly created PHP files or scripts owned by root outside the standard package installation paths
HTTP POST requests to Suricata rules management endpoints containing ../ sequences or encoded variants in ruleset parameters
Modifications to cron entries, rc.d scripts, or shell profiles on the firewall not associated with administrator activity

Detection Strategies

Inspect pfSense web server access logs for requests to Snort/Suricata package URLs containing traversal patterns or unusual ruleset identifiers
Compare file system state against a known-good baseline of the pfSense-pkg-snort package contents to identify unauthorized writes
Alert on authenticated web UI sessions that interact with Suricata configuration endpoints from unexpected source addresses

Monitoring Recommendations

Enable verbose web UI audit logging and forward logs off the appliance to a central SIEM for correlation
Monitor for new files owned by root outside package-managed directories using file integrity monitoring on the firewall
Track administrative account usage on pfSense and flag logins followed by Suricata configuration changes

How to Mitigate CVE-2025-12490

Immediate Actions Required

Update pfSense-pkg-snort to version 4.1.7 with PORTREVISION=1 or later, which contains the basename() sanitization fix
Restrict access to the pfSense web administration interface to trusted management networks only
Rotate credentials for all pfSense administrative accounts and review session activity for the Suricata package pages
Audit the firewall file system for unauthorized files created since the package was installed or last updated

Patch Information

The fix is delivered through the FreeBSD ports tree commit 36b2303dfca35a1183d76f26bcc6ce26d4ea682d, which bumps PORTREVISION on security/pfSense-pkg-snort and adds input sanitization in snort_rules.php. Refer to the Zero Day Initiative Advisory ZDI-25-979 and the GitHub Commit for FreeBSD Ports for the authoritative patch contents.

Workarounds

Disable or uninstall the Suricata/Snort package on pfSense systems where the IDS functionality is not actively required until the patch is applied
Limit pfSense web UI accounts with package management privileges to a minimal set of trusted administrators
Place the pfSense management interface behind a VPN or jump host to prevent direct network exposure of the vulnerable endpoint

bash

# Update the pfSense Snort/Suricata package from the pfSense shell
pkg update
pkg upgrade pfSense-pkg-snort
# Verify the installed version reflects the patched revision
pkg info pfSense-pkg-snort | grep -E 'Version|Revision'