CVE-2026-111232— Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
Quick assessment
Affected
Netgate pfSense CE
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Netgate pfSense CE 2.3.0 至 2.9.0 版本中存在一个存储型跨站脚本（XSS）漏洞。该漏洞允许具有“防火墙规则”或“NAT 端口转发”权限的已认证用户，通过“分隔符颜色”字段注入恶意脚本。攻击者可提交精心构造的 颜色值，该值被 函数未经验证地渲染到 HTML 的 属性中，当管理员在浏览器中访问相关页面时，恶意脚本将在其浏览器上下文中执行，从而以管理员权限执行 WebGUI 中的操作。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Netgate | pfSense CE | 2.3.0≤ 2.9.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111232
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
Source: CVE Program / CVE List V5
Vulnerability Description
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Netgate | pfSense CE | 2.3.0 ~ 2.9.0 | - |
|
II. Public POCs for CVE-2026-111232
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111232
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111232 (1)
Proof of Concept for CVE-2026-111232 (1)
Other References for CVE-2026-111232 (1)
Same Patch Batch · Netgate · 2026-10-15 · 21 CVEs total
| CVE-2026-110908 | 8.8 HIGH | pfSense FRR 2.0.2_1命令注入漏洞 |
| CVE-2026-111224 | 7.5 HIGH | Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh |
| CVE-2026-111223 | 7.2 HIGH | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner |
| CVE-2026-111218 | 7.2 HIGH | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters |
| CVE-2026-111215 | 7.2 HIGH | Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface |
| CVE-2026-111217 | 7.2 HIGH | Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID |
| CVE-2026-111214 | 7.2 HIGH | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php |
| CVE-2026-111216 | 7.2 HIGH | Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP |
| CVE-2026-111226 | 7.2 HIGH | Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php |
| CVE-2026-111231 | 7.2 HIGH | Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_inst |
| CVE-2026-111220 | 7.2 HIGH | Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid |
| CVE-2026-111229 | 7.2 HIGH | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync |
| CVE-2026-111222 | 6.6 MEDIUM | Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting |
| CVE-2026-111221 | 6.6 MEDIUM | Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection |
| CVE-2026-111219 | 6.6 MEDIUM | Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username |
| CVE-2026-111228 | 5.5 MEDIUM | Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php |
| CVE-2026-111227 | 5.5 MEDIUM | Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php |
| CVE-2026-111225 | 5.0 MEDIUM | Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh |
| CVE-2026-111230 | 4.9 MEDIUM | Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL |
| CVE-2026-111233 | 4.7 MEDIUM | Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php |
IV. Related Vulnerabilities
Same product: pfSense CE
-
CVE-2026-111233
Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via fir -
CVE-2026-111230
Netgate pfSense CE through 2.9.0 Local File Read via Dynamic -
CVE-2026-111231
Netgate pfSense CE through 2.9.0 Authorization Bypass via co -
CVE-2026-111229
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via -
CVE-2026-111228
Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via se
Same vendor: Netgate
-
CVE-2026-111233
Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via fir -
CVE-2026-111231
Netgate pfSense CE through 2.9.0 Authorization Bypass via co -
CVE-2026-111230
Netgate pfSense CE through 2.9.0 Local File Read via Dynamic -
CVE-2026-111229
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via -
CVE-2026-111228
Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via se
Same weakness: CWE-79
-
CVE-2026-103481
Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting v -
CVE-2026-109998
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scri -
CVE-2026-109512
Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cro -
CVE-2026-107758
Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cro -
CVE-2026-109207
RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored
V. Comments for CVE-2026-111232
No comments yet