CVE-2026-97730: pfSense Dashboard LFI

What Happened, in Brief

CVE-2026-97730 is a high-severity pfSense Dashboard local file inclusion (LFI) vulnerability. The affected Dashboard processing logic can be induced to load an attacker-controlled PHP file through a crafted widget sequence value. If that file contains PHP code, the Dashboard processes it as a widget and executes the code with the privileges of the pfSense web interface process.

This is not an unauthenticated Internet attack based on the available advisory information. Exploitation requires authenticated access, sufficient permission to modify Dashboard settings, and a way to write a file to the firewall, such as a PHP file in /tmp. Those prerequisites make the flaw particularly relevant to organizations with compromised administrative accounts, overly broad web-interface access, or another vulnerability that permits file creation.

For context on related firewall security issues, see our coverage of CVE-2026-9701.

Analyst’s Take: Treat this first as an administrative-access problem with a code-execution consequence. The flaw is not remotely exploitable by an unauthenticated user based on the available information, but a privileged account and a writable location are enough to turn Dashboard processing into execution on the firewall.

Technical Notes

The vulnerable workflow involves Dashboard widget sequence handling in index.php. A path traversal value such as the following was described in the vulnerability information:

../../../../../../../../../../../tmp/test

If /tmp/test.widget.php exists and is controlled by the attacker, the Dashboard may load and execute it as if it were a legitimate widget. The exact request format and complete exploit chain should not be inferred beyond the vendor and NVD descriptions.

What’s the Root Cause?

The root cause is inadequate validation of Dashboard widget layout or sequence data. The application accepts a value that is expected to identify a widget, but does not sufficiently constrain that value to an approved widget location or prevent traversal outside the intended directory. The resulting path can point to an arbitrary file rather than a trusted Dashboard component.

The file inclusion becomes code execution because the target file is processed as PHP. A user who could merely read an arbitrary local file would present a different risk profile; here, the attacker must also place or otherwise cause a PHP file to exist on the firewall. The combination of path traversal, server-side inclusion, and attacker-controlled file content produces the high-impact outcome.

The exploit chain depends on several conditions working together:

1. The attacker authenticates to the pfSense web interface.
2. The account can modify Dashboard settings or widget layout.
3. The attacker writes a PHP file to the firewall, for example under /tmp.
4. The attacker submits a crafted widget sequence.
5. The Dashboard loads the attacker-selected file and executes its PHP content.

Who Needs to Act

Netgate identifies pfSense Plus versions before 26.07 as affected. The advisory specifically identifies pfSense Plus 26.03.1 as affected, along with earlier releases. The fixed operational target is pfSense Plus 26.07 or later.

For pfSense CE, the vendor advisory identifies 2.8.1 and earlier as affected, with the correction in the 2.9.0 development/master line. The NVD summary uses the broader wording “before 2.9.0.” Because the vendor advisory is the more useful source for release handling, administrators should treat CE 2.8.1 and earlier as affected and plan for pfSense CE 2.9.0 or later, when available.

Inventory both production and standby firewalls. Include appliances managed by third parties, lab systems connected to production networks, and systems whose web interface is reachable through VPN or a management jump host. A firewall that is not Internet-facing can still be exposed if an attacker compromises an internal administrator workstation or management account.

Why This CVSS Score?

The reported CVSS score is 8.5, placing the vulnerability in the high-severity range. The available NVD response did not include the vector string, so the individual metric selections cannot be independently verified from the supplied record. Defenders should not assume a specific CVSS version, scope setting, or confidentiality, integrity, and availability subscore without the authoritative vector.

The score is consistent with a vulnerability that can result in arbitrary PHP code execution on a security appliance. Successful exploitation could allow an attacker to alter firewall behavior, access configuration data, interfere with network controls, or use the appliance as a foothold. Required authentication and elevated Dashboard permissions reduce exploitability compared with an unauthenticated flaw, but they do not make the issue low risk.

The practical risk depends on the exposure of the pfSense web interface and the quality of administrative access controls. Internet-exposed management, shared administrator accounts, weak multifactor authentication, and broad privileges increase the chance that the prerequisites can be met. A local or internal attacker who already controls a privileged account may be able to turn the vulnerability into firewall-level compromise.

Has It Been Exploited?

No confirmed in-the-wild exploitation was identified in the supplied NVD or CISA KEV data. CVE-2026-97730 is not listed in the CISA Known Exploited Vulnerabilities catalog as of the stated check. There is no CISA date added, remediation deadline, required action, or ransomware campaign flag for this CVE.

No reliable public proof of concept specifically targeting CVE-2026-97730 was identified. Search results included proof-of-concept material for unrelated pfSense vulnerabilities, including CVE-2015-2294, CVE-2023-48123, and CVE-2023-42326. Those references are not evidence of a public exploit for this vulnerability.

The absence of a KEV entry or a reliable public PoC does not prove that exploitation has never occurred. It means that the supplied sources do not confirm exploitation. The exploit mechanics are sufficiently clear that organizations should remediate based on impact and prerequisites rather than waiting for a public weaponized exploit.

How Do I Know If I’m Hit?

Start by identifying every pfSense instance and comparing its version with the affected ranges. A system running pfSense Plus 26.03.1 or an earlier Plus release, or pfSense CE 2.8.1 or earlier, should be treated as vulnerable until upgraded or remediated. Review whether its web interface is reachable from untrusted networks and which accounts can edit Dashboard settings.

Investigate authentication and configuration activity around the Dashboard. Look for successful logins by unusual users, access from unexpected source addresses, changes to widget layout or sequence values, and administrative activity outside normal maintenance windows. The supplied research does not provide a vendor-specific event ID or guaranteed log message for this CVE, so absence of a matching string does not clear a system.

Technical Notes

Search centralized web-interface and authentication logs for indicators associated with the described exploitation path. The following examples are starting points, not signatures guaranteed to identify the CVE:

grep -Ei 'index\.php|dashboard|widget|sequence|\.widget\.php|/tmp/' /var/log/* 2>/dev/null

A SIEM search can prioritize requests or parameters containing traversal sequences and Dashboard terms:

(event.url contains "index.php" OR event.request contains "dashboard")
AND (
  event.request contains "../"
  OR event.request contains "widget"
  OR event.request contains "sequence"
  OR event.request contains ".widget.php"
)

Review file activity in writable locations, especially unexpected PHP files under /tmp or other temporary directories. Defenders can collect file metadata and content hashes during an incident:

find /tmp -type f \( -name '*.php' -o -name '*.widget.php' \) \
  -printf '%TY-%Tm-%Td %TH:%TM:%TS %u %g %m %p\n' 2>/dev/null

These checks are not a substitute for forensic analysis. If suspicious PHP files, unauthorized Dashboard changes, or anomalous administrator sessions are found, preserve logs and configuration backups before removing artifacts. Assume that credentials used to access the web interface may require rotation.

What Do I Do About It?

Upgrade pfSense Plus systems to 26.07 or later. Upgrade pfSense CE systems to 2.9.0 or later when available. Use the supported pfSense update workflow and verify the resulting version after the reboot. Before upgrading, confirm that a recent configuration backup is available and that the appliance has a documented recovery path.

The vendor also identifies corrections in the Plus 26.07 release line and the CE 2.9.0 development line. The cited correction revisions are:

61e736e10e6f6542ce7a7c7bed37fb333c09467f
8fa0daeafdfbbcf9629c51dfc74c55bdab83554d
c30c57b845f99c0f14a44bdb37681fce939cf056
ecc9b4f3a2ccbbce3a956f061d784490e6fbf465

For systems that cannot be upgraded immediately, Netgate recommends applying the fix through the System Patches package. The advisory notes that pfSense Plus 26.03.1 and pfSense CE 2.8.1 users may use the recommended patches list after installing or updating System Patches. If the package does not apply directly, follow the vendor’s manual patch instructions rather than copying changes from an unverified third-party source.

Technical Notes

The supported immediate workflow is:

1. Log in through a trusted management path.
2. Open System > Package Manager > Available Packages.
3. Install or update the System Patches package.
4. Open the System Patches interface and apply the recommended patch for CVE-2026-97730, if offered.
5. Reboot or reload services as directed by the patch procedure.
6. Verify the installed pfSense version and confirm that the patch remains applied.

Where command-line administration is part of the organization’s approved pfSense procedure, the platform’s upgrade utility can be invoked as follows:

pfSense-upgrade -y

The command does not replace version verification or the vendor’s release guidance. Confirm that the resulting release is pfSense Plus 26.07 or later, or pfSense CE 2.9.0 or later when that release is available for the deployment.

Until remediation is complete, restrict web-interface access to trusted administrators and management networks. Disable unnecessary exposure through WAN interfaces, require strong unique credentials and multifactor authentication where supported, and review which accounts can modify Dashboard settings. For teams reviewing administrator credential hygiene, a password manager such as 1Password can help enforce unique credentials and secure sharing. These measures limit access to the vulnerable workflow but do not correct the underlying vulnerability.

Organizations should also apply least-privilege and segmented management practices consistent with a zero-trust security model. Keep firewall administration separate from general user access, limit management paths to approved networks, and monitor privileged sessions.

Where This Comes From

The primary source is Netgate’s pfSense security advisory, which provides the affected versions, remediation guidance, and correction references. Administrators should use the advisory as the authoritative source when its version wording differs from a secondary database.

Additional references include the NVD record, the pfSense upgrade guide, the vendor vulnerability tracking issue, and the CISA KEV catalog:

• Netgate pfSense Security Advisory
• pfSense Upgrade Guide
• pfSense Redmine issue 16947
• NVD record for CVE-2026-97730
• CISA Known Exploited Vulnerabilities Catalog

The available research does not provide the CVSS vector string or an EPSS result. The frontmatter EPSS value is therefore recorded as 0.0 to indicate that no supplied EPSS percentile was available, not to claim a zero exploitation probability. Organizations should prioritize remediation using the confirmed impact, affected versions, and authentication prerequisites.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.