In pfSense CE 7.0.8_2, the /suricata/suricata_ip_reputation.php endpoint improperly handles the iplist parameter by failing to sanitize directory traversal sequences. This parameter is used directly in a file existence check operation. Although the contents of the targeted files cannot be accessed, the server response reveals whether the file exists, allowing an attacker with appropriate authentication and permissions to enumerate files on the system. This is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

An attacker authenticated with at least 'WebCfg - Services: suricata package' permissions can enumerate files on the server by exploiting the path traversal vulnerability. This information disclosure could aid further attacks or reconnaissance but does not allow direct file content access or modification.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Since exploitation requires authenticated access with specific permissions, restricting user privileges and ensuring strong authentication controls can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.