CVE-2026-111232 Overview
CVE-2026-111232 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Netgate pfSense Community Edition versions 2.3.0 through 2.9.0. The flaw resides in the firewall rule and NAT port forward separator color field. Authenticated users with Firewall: Rules or NAT: Port Forward privileges can submit a crafted separator[] color value that the display_separator() function renders unencoded into HTML class attributes. When an administrator views the affected page, the injected script executes in their browser session and performs WebGUI actions with their privileges.
Critical Impact
Authenticated low-trust operators can escalate privileges by hijacking administrator sessions and executing arbitrary WebGUI actions on the pfSense firewall.
Affected Products
- Netgate pfSense Community Edition 2.3.0 through 2.9.0
- pfSense WebGUI firewall rules component (firewall_rules.php)
- pfSense filter include module (filter.inc)
Discovery Timeline
- 2026-10-15 - CVE-2026-111232 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-111232
Vulnerability Analysis
The vulnerability occurs when pfSense renders user-controlled separator color values into the firewall rules management interface. The display_separator() function in filter.inc concatenates the submitted color string directly into HTML class attributes without encoding. An authenticated operator with firewall or NAT port forward privileges can store a payload that persists in the configuration. Any administrator who subsequently loads the firewall rules page triggers execution of the attacker-supplied script within the administrator's authenticated WebGUI session.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The separator[] color parameter accepts arbitrary strings without validation against an allow-list of valid CSS color classes. The output path in display_separator() emits the stored value into a class="..." attribute without applying htmlspecialchars() or equivalent encoding. See the GitHub Filter Implementation Code and GitHub Firewall Rules Code for the affected code paths.
Attack Vector
Exploitation requires an authenticated account with Firewall: Rules or NAT: Port Forward privileges. The attacker creates or edits a separator and submits a crafted separator[] color value containing attribute-breaking characters followed by an event handler or script tag. The payload is stored in the pfSense configuration. Payload execution requires user interaction, specifically an administrator loading the firewall rules or NAT page in their browser. On trigger, the script executes WebGUI requests under the administrator's session, enabling configuration changes or further privilege escalation. Technical details are available in the Abraxas Labs Research and VulnCheck Advisory on pfSense XSS.
A proof-of-concept is published in the GitHub XSS Vulnerability PoC repository.
Detection Methods for CVE-2026-111232
Indicators of Compromise
- Separator entries in config.xml whose color field contains characters outside the expected CSS class token set (quotes, angle brackets, whitespace, or on* event handler strings).
- Unexpected administrator-initiated WebGUI configuration changes immediately following a firewall rules page load.
- New or modified firewall rules, NAT entries, or user accounts created without a matching operator audit entry.
Detection Strategies
- Audit the pfSense configuration backup for <separator> elements and validate every color value against the documented pfSense palette (bg-info, bg-warning, bg-danger, bg-success, etc.).
- Review WebGUI access logs for separator edit requests originating from non-administrator accounts followed by administrator sessions on firewall_rules.php.
- Monitor for outbound HTTP requests from administrator browsers to unfamiliar hosts during pfSense WebGUI sessions.
Monitoring Recommendations
- Forward pfSense WebGUI and system logs to a centralized log platform and alert on configuration diffs that include separator mutations.
- Track privilege assignments for Firewall: Rules and NAT: Port Forward and alert when non-administrator accounts receive these roles.
- Baseline administrator browser behavior against the pfSense management IP and flag anomalous XHR activity.
How to Mitigate CVE-2026-111232
Immediate Actions Required
- Upgrade pfSense CE to a fixed release once Netgate publishes a patched version above 2.9.0.
- Audit all existing separators and remove or sanitize any entry whose color value is not a known-good CSS class.
- Restrict Firewall: Rules and NAT: Port Forward privileges to trusted operators only and remove them from shared or service accounts.
Patch Information
At publication time no vendor advisory URL is listed in the NVD record. Monitor Netgate release notes for pfSense CE and apply the first release that supersedes 2.9.0 containing a fix for the display_separator() output encoding. Refer to the VulnCheck Advisory on pfSense XSS for ongoing tracking.
Workarounds
- Restrict WebGUI access to a dedicated management network and require VPN access for administrators.
- Enforce separate browsers or browser profiles for pfSense administration to limit cross-session script impact.
- Enable WebGUI two-factor authentication and reduce administrator session lifetimes to shrink the exploitation window.
- Remove unneeded separator entries and avoid delegating separator creation to lower-privileged roles until patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
