Threats tagged 'ghsa-pc4f-6357-r2v6'

A Local File Inclusion (LFI) vulnerability exists in Netgate pfSense Plus before version 26.07 and pfSense CE before version 2.9.0. This flaw is in the Dashboard widget sequence data handling, allowing an authenticated attacker with privileges to modify Dashboard settings to execute arbitrary PHP code by submitting a crafted widget sequence value referencing a file they control. Exploitation requires the ability to write files to the system, such as placing a PHP file in /tmp. The Dashboard then reads and executes this file as a widget.