CVE-2026-97730

Executive Summary

CVE-2026-97730 is a local file inclusion (LFI) vulnerability in the pfSense Plus and pfSense CE dashboard (index.php) widget sequence data handling. An authenticated attacker with the ability to modify dashboard settings and write files to the system can supply a path traversal payload in the widget sequence value, causing the dashboard to load and execute an arbitrary PHP file. Successful exploitation leads to remote code execution on the firewall with high impact to confidentiality, integrity, and availability, and no public proof-of-concept or patch is currently available.

Technical Analysis

The vulnerability resides in how the pfSense dashboard (index.php) processes widget sequence data. Widgets on the pfSense dashboard are arranged and loaded based on a sequence value that determines which widget files are included and rendered. In CVE-2026-97730, this sequence handling does not adequately restrict the file path used to locate a widget, which allows path traversal sequences to be introduced into the widget sequence value.

The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, which maps to:

• AV:N (Network): The dashboard is accessed over the network.
• AC:H (High): Exploitation requires specific conditions — an authenticated account with privileges to modify dashboard settings and the ability to write an arbitrary file to the pfSense filesystem (for example /tmp/test.widget.php).
• PR:L (Low): The attacker must be authenticated, but only with low-level privileges relative to the full administrative context required for many other pfSense operations.
• UI:N (None): No user interaction is required beyond the attacker’s own actions.
• S:C (Changed): The impact scope changes because loading and executing an attacker-controlled PHP file shifts the security context from the dashboard application into the underlying PHP execution environment.
• C:H/I:H/A:H: High impact to confidentiality, integrity, and availability — consistent with arbitrary PHP code execution on a security appliance.

The weakness is classified as CWE-24, Path Traversal: '.../...//'. The vulnerable area is the Dashboard’s index.php widget sequence data handling. The NVD description explicitly states that a crafted widget sequence value containing a path traversal payload such as ../../../../../../../../../../../tmp/test can cause the Dashboard to read and execute the referenced file as if it were a standard widget. Because the dashboard processes the file as PHP, the included content is executed rather than merely disclosed. This turns a file inclusion flaw into arbitrary PHP code execution once the attacker can place a PHP file at a predictable path.

pfSense is a widely deployed open-source firewall and router platform. Its dashboard is normally restricted to authenticated users, but any account with permission to change dashboard configuration and write files could trigger this flaw. The required conditions for exploitation are non-trivial — the attacker must already have authenticated access and a separate file-write primitive — which is consistent with the High attack complexity rating. However, once those conditions are met, the consequences are severe because code executes in the context of the pfSense web interface.

No public exploit code, Nuclei template, or proof-of-concept is associated with this CVE in the provided data. The vendor/product field is listed as Unknown / Unknown, but the NVD description identifies the affected software as Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0.

Exploitation Scenarios

The following scenarios are inferred from the vulnerability class and the explicit technical details in the NVD description. No public PoC is available, and no implementation details beyond those in the description should be assumed.

1. Reconnaissance and target identification The attacker identifies a pfSense Plus or pfSense CE deployment that is accessible and running a version before 26.07 (Plus) or before 2.9.0 (CE). The attacker needs valid credentials for an account that can modify Dashboard settings and, separately, write files to the system. This may be obtained through credential reuse, weak credentials, a phishing campaign against firewall administrators, or a separate vulnerability that provides file write access.

2. Triggering the flaw class The attacker interacts with the pfSense Dashboard to modify the widget sequence value. Instead of a legitimate widget identifier, the attacker submits a value containing path traversal, such as a sequence that resolves to ../../../../../../../../../../../tmp/test. This value is accepted by the widget sequence data handling because it is not properly constrained to a legitimate widget path.

3. Payload and execution method The attacker first writes a PHP payload to a location they can control on the pfSense filesystem, for example /tmp/test.widget.php, using whatever file-write capability they possess. The crafted widget sequence value then references that file via path traversal. When the Dashboard loads widgets, it reads the traversed path and executes the referenced file as PHP, effectively running the attacker’s code. The payload is executed in the context of the pfSense web interface.

4. Post-exploitation impact Because the payload runs as PHP within the pfSense management interface, the attacker can execute commands, read or modify configuration, access secrets and credentials available to the web process, and pivot into the firewall’s network. On a perimeter firewall, this can lead to full compromise of the appliance, disruption of network protection, and use of the device as a beachhead for lateral movement. The CVSS subscores reflect high confidentiality, integrity, and availability impact and a changed scope.

No public exploit is available, and the attack chain depends on the preconditions noted above, particularly the ability to write a PHP file and the possession of an authenticated low-privilege account with dashboard modification rights.

Impact Assessment

Successful exploitation of CVE-2026-97730 results in arbitrary PHP code execution on a pfSense firewall. Because pfSense is often deployed at the network perimeter and may act as the primary security control between trusted and untrusted networks, compromise has a broad blast radius. An attacker who achieves code execution can:

• Read, alter, or exfiltrate firewall configuration data, including rules, VPN settings, and stored credentials or keys accessible to the web interface.
• Modify firewall rules to permit or redirect traffic, disable logging, or create persistence.
• Use the firewall as a pivot point into internal networks that trust the appliance.
• Disrupt network availability by altering or crashing services.

The CVSS score of 8.5 and vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H reflect a high-severity issue: network-reachable, requiring authentication and specific conditions, but with high confidentiality, integrity, and availability impact and a changed scope. The CISA KEV catalog does not list this CVE, and EPSS has not yet scored it, so current exploitation likelihood data is unavailable. The absence of a public proof-of-concept or Nuclei template may reduce opportunistic exploitation, but the high impact warrants prioritized remediation.

Detection Guidance

Sigma Rule

title: Potential pfSense Dashboard Widget Sequence Path Traversal
id: 8f4b2c1e-7d3a-4b9c-9e2f-1a6c5d8e4f21
status: experimental
description: Detects path traversal sequences in pfSense dashboard widget sequence handling and suspicious PHP file creation in /tmp that may precede CVE-2026-97730 exploitation.
author: SOC
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  traversal_pattern:
    - '../../../../../../../../../../../tmp/'
    - '../../../../tmp/'
    - '..%2f..%2f'
  widget_context:
    - 'widget'
    - 'sequence'
    - 'index.php'
  tmp_php_write:
    - '/tmp/'
    - '.widget.php'
  condition: (traversal_pattern and widget_context) or tmp_php_write
falsepositives:
  - Legitimate administrative activity that references temporary widget files
  - Development or debugging on non-production systems
level: high

YARA Rule

rule CVE_2026_97730_PfSense_Widget_Traversal
{
    meta:
        description = "Detects path traversal payloads targeting pfSense dashboard widget sequence handling (CVE-2026-97730)"
        author = "SOC"
        reference = "CVE-2026-97730"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "../../../../../../../../../../../tmp/"
        $b = ".widget.php"
        $c = "sequence"
        $d = "widget"
    condition:
        ($b and $c and $d) or $a
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97730 pfSense Dashboard Widget Sequence Path Traversal Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"index.php"; http_client_body; content:"sequence"; http_client_body; content:"../../../../"; http_client_body; content:".widget.php"; reference:cve,CVE-2026-97730; classtype:web-application-attack; sid:9773001; rev:1;)

Elastic Detection

sequence by host.id with maxspan=30s
  [file where file.path : "/tmp/*" and file.name : "*.widget.php"]
  [process where process.name : "php*" and process.args : "*.widget.php" or process.parent.name : "php*"]

Splunk SPL Query

index=web OR index=proxy OR index=linux
(sourcetype=access_combined OR sourcetype=syslog OR sourcetype=auditd)
(
  (uri="*index.php*" AND (uri="*sequence*" OR form_data="*sequence*"))
  OR
  (form_data="*../../../../*" AND form_data="*.widget.php*")
  OR
  (file_path="/tmp/*.widget.php")
)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, form_data, file_path, host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,pfsense,cve-2026-97730,">
  <rule id="977300" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>index\.php</url>
    <match>sequence</match>
    <regex>\.\./\.\./|\.widget\.php</regex>
    <description>CVE-2026-97730: Possible pfSense dashboard widget sequence path traversal attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="977301" level="12">
    <decoded_as>syscheck</decoded_as>
    <file>/tmp/.*\.widget\.php</file>
    <description>CVE-2026-97730: Suspicious PHP widget file created in /tmp</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict access to the pfSense dashboard to trusted management networks only; do not expose the web interface to the internet or to untrusted segments.
• Enforce strong authentication and least privilege for all dashboard accounts. Review which accounts can modify Dashboard settings and reduce that set to the minimum necessary.
• Monitor for unexpected PHP files in /tmp or other writable locations, especially files ending in .widget.php, and remove them promptly.
• Where possible, disable or lock down components that allow users to modify dashboard widget configuration until a patch is available.
• Apply strict file system permissions and monitoring to detect or prevent non-administrative file writes.

2. Patch/upgrade steps

• No vendor patch is currently available. Track Netgate security advisories for pfSense Plus 26.07 and pfSense CE 2.9.0 or later. Upgrade to the fixed release as soon as it is published.
• Until an upgrade is possible, apply the mitigations above and consider additional compensating controls such as a web application firewall with rules tailored to the widget sequence parameter.

3. Long-term hardening

• Adopt a patch management process that prioritizes perimeter devices and tracks vendor advisories continuously.
• Implement network segmentation so that firewall management interfaces are not reachable from untrusted networks.
• Enforce multifactor authentication for administrative access and audit account permissions regularly.
• Monitor CVSS, EPSS, and CISA KEV feeds for this CVE; the EPSS score is not yet available and the CVE is not currently in KEV.
• Review custom code paths that resolve user-supplied values to file paths and enforce allowlisting or canonical path validation.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97730
• Netgate pfSense security advisories: https://www.netgate.com/security-advisories
• pfSense documentation and release notes: https://docs.netgate.com/
• CWE-24 Path Traversal: '.../...//': https://cwe.mitre.org/data/definitions/24.html
• CISA KEV catalog (check for future inclusion): https://www.cisa.gov/known-exploited-vulnerabilities-catalog