CVE-2026-111232: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Netgate pfSense CE

CVE-2026-111232 is a stored cross-site scripting vulnerability in Netgate pfSense CE affecting versions 2.3.0 through 2.9.0. Authenticated users who have Firewall: Rules or NAT: Port Forward privileges can exploit this by submitting a crafted separator[] color value. The display_separator() function renders this input unencoded into HTML class attributes, enabling script execution in the context of administrators' browsers. This allows attackers to perform WebGUI actions with the privileges of the administrator, potentially leading to unauthorized configuration changes.

The vulnerability allows authenticated users with specific privileges to execute arbitrary scripts in administrators' browsers. This can result in unauthorized administrative actions within the pfSense WebGUI, potentially compromising the firewall's configuration and security. The CVSS 4.8 score reflects a medium severity with network attack vector, low complexity, and required privileges but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with Firewall: Rules or NAT: Port Forward privileges and monitor for suspicious activity. Avoid using untrusted input in the separator color field. Follow vendor updates for patches or official mitigations.