CVE-2026-111233: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Netgate pfSense CE

Netgate pfSense CE versions 2.7.1 through 2.9.0 contain a reflected cross-site scripting vulnerability in the firewall_rules.php component. The vulnerability arises from improper neutralization of input in the 'if' parameter, which is not encoded before being reflected in the web page. When the Require Firewall Interface option is enabled, an attacker can craft a GET request containing malicious script in this parameter. If a user with firewall rules privileges opens this link, the script executes in their WebGUI session with their privileges. The CVSS 4.0 vector indicates network attack vector, high attack complexity, partial user interaction, no privileges required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary script in the context of the WebGUI with the privileges of users who have firewall rules permissions. This could lead to limited unauthorized actions within the WebGUI session of the targeted user. The overall impact is low as indicated by the CVSS score of 2.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the non-default Require Firewall Interface option if feasible and avoid opening untrusted links that could exploit this vulnerability. Monitor official Netgate advisories for updates and patches addressing this issue.