CVE-2026-97730 Overview
CVE-2026-97730 is a Local File Inclusion (LFI) vulnerability in Netgate pfSense Plus and pfSense CE. The flaw resides in the Dashboard component (index.php) where widget sequence data is processed without proper path validation. An authenticated attacker with Dashboard modification privileges and the ability to write files to the firewall can inject a path traversal payload into the widget sequence value. The Dashboard then reads and executes the attacker-controlled file as PHP code. The weakness is tracked as CWE-24: Path Traversal: '../filedir'.
Critical Impact
Authenticated attackers can achieve arbitrary PHP code execution on the pfSense firewall, compromising a critical network perimeter device.
Affected Products
- Netgate pfSense Plus versions prior to 26.07
- pfSense CE versions prior to 2.9.0
- Dashboard widget sequence handler in index.php
Discovery Timeline
- 2026-09-25 - CVE-2026-97730 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-97730
Vulnerability Analysis
The vulnerability stems from unsafe handling of user-supplied widget sequence values in the pfSense Dashboard. The Dashboard reads the widget sequence string, resolves each entry to a PHP file, and includes it during page rendering. The resolver does not sanitize path traversal sequences, so an attacker can reference files outside the intended widget directory.
Exploitation requires two preconditions. First, the attacker must authenticate with privileges allowing Dashboard setting modifications. Second, the attacker must write an arbitrary file to a reachable path on the firewall, such as /tmp/test.widget.php. Combined, these permit full PHP code execution in the context of the web user interface.
Because pfSense firewalls typically sit at the network perimeter and manage routing, VPN, and filtering policy, successful exploitation grants control over traffic inspection and network segmentation. The high attack complexity reflects the dual precondition of elevated UI privileges and arbitrary file write access.
Root Cause
The Dashboard widget loader concatenates attacker-controlled sequence values into a filesystem path before passing them to a PHP include/require operation. No normalization or allow-list validation rejects ../ traversal sequences, enabling inclusion of files outside the widgets directory.
Attack Vector
An authenticated user submits a crafted Dashboard configuration containing a widget sequence like ../../../../../../../../../../../tmp/test. The Dashboard appends .widget.php or performs equivalent resolution, locating the attacker-written file at /tmp/test.widget.php. On the next Dashboard render, the file is included and its PHP code executes with web server privileges. Further technical context is published in the pfSense Issue Tracker Entry and the Netgate Security Advisory.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-97730
Indicators of Compromise
- Unexpected .widget.php files written to writable directories such as /tmp, /var/tmp, or user home paths
- Dashboard configuration entries containing ../ sequences in the widget sequence field within config.xml
- HTTP POST requests to index.php with sequence parameters containing path traversal patterns
- New or modified PHP files on the firewall with recent timestamps outside the standard pfSense installation paths
Detection Strategies
- Audit config.xml for widget sequence values that reference paths outside /usr/local/www/widgets/widgets/
- Review web server access logs for authenticated POST requests to the Dashboard containing encoded traversal sequences
- Monitor filesystem write events to /tmp and other writable paths for files matching *.widget.php naming patterns
Monitoring Recommendations
- Enable verbose authentication and configuration-change logging on pfSense and forward logs to a centralized SIEM
- Alert on any administrative account activity originating from unexpected source IP ranges
- Baseline the set of installed widget files and alert on deviations across the fleet
How to Mitigate CVE-2026-97730
Immediate Actions Required
- Upgrade pfSense Plus to version 26.07 or later, and pfSense CE to version 2.9.0 or later
- Restrict web UI access to trusted management networks using firewall rules on the WAN and LAN interfaces
- Audit all administrative accounts and remove unused privileged users with Dashboard modification rights
- Rotate credentials for any account with Dashboard or file write privileges following patching
Patch Information
Netgate has released fixed versions in pfSense Plus 26.07 and pfSense CE 2.9.0. Upgrade instructions are available in the Netgate Upgrade Guide. Full remediation details are published in the Netgate Security Advisory pfSense-SA-26_18.webgui.
Workarounds
- Limit the number of accounts with permissions to modify Dashboard settings or write to the firewall filesystem
- Enforce multi-factor authentication for all pfSense administrative accounts
- Restrict access to the web UI via System > Advanced > Admin Access, binding it to a dedicated management VLAN
- Review config.xml backups for anomalous widget sequence entries before restoring configurations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
