pfSense EUVD-2026-86509

Exploitation requires an authenticated session on the pfSense web GUI with two specific capabilities: privileges to modify Dashboard widget settings, AND the ability to write arbitrary files to the pfSense filesystem (e.g. dropping /tmp/test.widget.php). The attacker then supplies a widget 'sequence' value containing a relative path-traversal string (../../../../../../tmp/test) that the Dashboard's index.php resolves and include()s as a widget, executing the planted PHP. Limiting factors: it is not remote-unauthenticated - it presumes an already-privileged/near-admin actor who can place files on the box, the management interface must be reachable, and AC:H reflects the multi-step file-plant-plus-traversal setup. Affected only on pfSense Plus < 26.07 and pfSense CE < 2.9.0.

The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.5) rates this High, but the raw score overstates real-world ease of exploitation. The description imposes a heavy precondition that the vector only partially captures: the attacker must ALREADY have (a) privileges to modify Dashboard settings AND (b) the ability to write arbitrary files onto the pfSense filesystem (e.g. drop /tmp/test.widget.php). An actor who can already write arbitrary files to a firewall's local filesystem is effectively near-administrative, so this reads more as a privilege/functionality-escalation-to-code-execution primitive than a remote pre-auth compromise - which is why AC:H is appropriate and why PR:L arguably understates the requirement (PR:H is defensible). No EPSS score and no KEV entry were provided, and no public exploit was identified - only a vendor patch attachment (redmine.pfsense.org/attachments/7146) and a signed advisory (pfSense-SA-26_18.webgui) exist, indicating a coordinated MITRE-reported fix rather than observed in-the-wild abuse. Net: a genuine code-execution issue on a widely deployed firewall, but the file-write + dashboard-config prerequisites and AC:H place it below drop-everything priority; patch on a normal cycle unless the management interface is broadly exposed.

An authenticated pfSense administrator (or an attacker who has hijacked such a session) who can both edit Dashboard widget settings and write files to the firewall drops a malicious PHP file such as /tmp/test.widget.php, then submits a crafted widget sequence value containing a path-traversal payload (../../../../../../tmp/test) so the Dashboard index.php includes and executes it. Because the pfSense web GUI runs as root, this yields arbitrary PHP/OS code execution on the firewall. No public exploit code was identified at time of analysis; only the vendor patch is available.