pfSense CE CVE-2026-111222

Requires an authenticated pfSense CE account holding General Setup privileges (administrator-equivalent) to reach the System > General Setup timezone field. Exploitation depends on injecting a quote and newline into the unvalidated timezone value to append an auto_prepend_file directive to php.ini. Code execution is NOT immediate: the malicious directive only runs after php.ini is regenerated, which occurs at system boot or on a php-fpm restart - the attacker may need to wait for or indirectly trigger this, which limits reliability. Affected: Netgate pfSense CE through 2.9.0. The required admin-level privilege is the primary limiting factor, making this a post-authentication root-escalation rather than an unauthenticated remote compromise.

This is a credible but conditional privilege-escalation/code-execution issue rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N, score 7.5) is internally consistent with the description: exploitation is network-reachable through the pfSense web GUI (AV:N) but requires high privileges - an authenticated account with General Setup privileges, i.e. effectively an administrator (PR:H) - and carries attack complexity plus an attack requirement (AC:H/AT:P) because malicious php.ini directives only take effect after php.ini is regenerated at boot or on a php-fpm restart, which the attacker cannot always trigger on demand. Technical impact is high across confidentiality, integrity and availability (VC:H/VI:H/VA:H) since the injected auto_prepend_file executes PHP as root. A public exploit (abraxas/pfsense-timezone-phpini) exists, which raises practical risk, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The PR:H requirement is the dominant mitigating factor - this is primarily a post-authentication root-escalation primitive for an attacker who already holds admin-equivalent web access, so real-world priority is moderate and should be weighed against how exposed and trusted the pfSense admin interface is in a given environment. MISSING DATA: EPSS and KEV status are absent from the input and are treated as 'not present,' not confirmed-negative.

An attacker who already holds (or has phished/credential-stuffed) a pfSense web account with General Setup privileges submits a crafted timezone value containing an embedded quote and newline, injecting an auto_prepend_file directive referencing attacker-controlled content under /var/db/zoneinfo. When php.ini is regenerated at the next boot or php-fpm restart, the attacker's PHP executes as root. A public proof-of-concept exploit is available, lowering the effort to reproduce.