CVE-2026-111222 Overview
CVE-2026-111222 is a php.ini injection vulnerability in Netgate pfSense CE through version 2.9.0. The flaw resides in the General Setup page, where an authenticated administrator can submit a crafted timezone value that is written verbatim into the regenerated php.ini file. By embedding a quote and a newline, an attacker can append arbitrary PHP directives such as auto_prepend_file, which point to attacker-controlled content under /var/db/zoneinfo. When php-fpm restarts or the firewall reboots, the injected PHP executes as root. The weakness is tracked under CWE-93: Improper Neutralization of CRLF Sequences.
Critical Impact
Authenticated administrators with General Setup privileges can achieve persistent root-level PHP code execution on the pfSense host after php-fpm restart or system reboot.
Affected Products
- Netgate pfSense CE (Community Edition) versions up to and including 2.9.0
- Deployments exposing the WebGUI to users with General Setup privileges
- pfSense installations that regenerate php.ini at boot through rc.php_ini_setup
Discovery Timeline
- 2026-10-15 - CVE-2026-111222 published to the National Vulnerability Database
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-111222
Vulnerability Analysis
The vulnerability arises from the pfSense General Setup workflow that persists the administrator-selected timezone and later reuses it to build the system php.ini. The timezone string travels from the WebGUI handler in system.php into the configuration store, then into system.inc, and finally into the shell script rc.php_ini_setup that writes /usr/local/etc/php.ini. At no stage does pfSense validate that the submitted timezone matches a known zoneinfo entry or strip control characters. An attacker who already holds General Setup privileges can therefore insert additional lines into php.ini, including auto_prepend_file, which forces every PHP invocation to load an attacker-staged file. Because php-fpm runs as root on pfSense, the injected PHP executes with full system privileges once the service restarts.
Root Cause
The root cause is missing input neutralization on the timezone parameter before it is interpolated into a configuration file. The code paths in system.inc (lines 2377-2380) and rc.php_ini_setup (lines 163-166 and 220) write the raw value into php.ini without escaping quotes or newline characters, which allows CRLF injection into a parsed configuration format.
Attack Vector
Exploitation requires an authenticated session with General Setup privileges and network access to the pfSense WebGUI. The attacker submits a timezone value containing a closing quote followed by a newline and additional php.ini directives such as auto_prepend_file=/var/db/zoneinfo/<attacker_file>. After saving, the attacker must wait for a reboot or trigger a php-fpm restart. On the next PHP execution, pfSense loads the attacker-controlled file and runs its contents as root. See the VulnCheck advisory and Abraxas Labs research for the full exploitation walkthrough.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-111222
Indicators of Compromise
- Unexpected directives inside /usr/local/etc/php.ini, especially auto_prepend_file, auto_append_file, or include_path entries pointing to /var/db/zoneinfo or other writable paths.
- Non-standard values in the pfSense config.xml<timezone> element containing quotes, newlines, or characters outside the standard IANA zoneinfo set.
- New or modified files under /var/db/zoneinfo/ that contain PHP tags rather than binary zoneinfo data.
Detection Strategies
- Compare the current php.ini to a known-good baseline after each configuration change and alert on added directives.
- Audit pfSense WebGUI access logs for POST requests to system.php where the timezone field deviates from the allowed zoneinfo list.
- Monitor php-fpm process starts and correlate with configuration changes to detect activation of injected directives.
Monitoring Recommendations
- Enable file-integrity monitoring on /usr/local/etc/php.ini, /var/db/zoneinfo/, and /cf/conf/config.xml.
- Forward pfSense WebGUI and system logs to a central SIEM and alert on configuration-save events performed by non-standard administrator accounts.
- Track administrator privilege assignments and flag any account that gains General Setup rights outside a documented change window.
How to Mitigate CVE-2026-111222
Immediate Actions Required
- Restrict WebGUI access to trusted management networks and enforce multi-factor authentication for all administrator accounts.
- Review which accounts currently hold General Setup privileges and remove the role from users that do not require it.
- Inspect /usr/local/etc/php.ini and /var/db/zoneinfo/ for unexpected content, then rebuild php.ini and remove any injected files.
Patch Information
At the time of publication, no fixed version is referenced in the NVD entry for Netgate pfSense CE. Monitor the Netgate security advisories and the VulnCheck advisory for an updated release addressing the timezone validation gap, and upgrade as soon as a patched build is available.
Workarounds
- Limit the admin role and any custom role granting General Setup to a minimal set of trusted operators.
- Place the pfSense WebGUI behind a VPN or jump host so that unauthenticated attackers cannot pivot to the General Setup page even if they obtain stolen credentials.
- Validate the stored <timezone> value in config.xml against the IANA zoneinfo list after every change and revert any entry that contains quotes or newline characters.
# Configuration example: verify php.ini and timezone value are clean
grep -nE 'auto_prepend_file|auto_append_file' /usr/local/etc/php.ini
xmllint --xpath '//system/timezone/text()' /cf/conf/config.xml
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
