CVE-2026-67189
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records are incorporated without sanitization into AJAX responses and rendered as HTML. An attacker who controls a PTR record and generates sufficient traffic can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session and enabling account creation and arbitrary OS command execution.
Risk Assessment
Administrator session hijacking could lead to full firewall compromise, including account creation and arbitrary OS command execution.
Recommendation
Upgrade pfSense to version 26.07 (Plus) or later (CE) and consider limiting trust in PTR records.
Original NVD description (English source)
pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution.