CVE-2026-97730

Description

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.

Overview

State: PUBLISHED
Assigner (CNA): mitre
CVSS severity: HIGH
CVSS score: 8.5 / 10
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Effective score: 8.5 / 10 HIGH source: CNA overview
CWE(s): CWE-24
Reserved: 2026-09-25
Published: 2026-09-25 02:43 UTC
Last updated: 2026-09-25 02:43 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97730.json
Linked Threat: CVE-2026-97730 — CVE-2026-97730

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-25 03:16:59 UTC
NVD last modified: 2026-09-25 03:16:59 UTC
NVD CVSS v3.1: 8.5 / 10 HIGH source: cve@mitre.org
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 6.0 / 10
EPSS score: 0.0103 (probability of exploitation in next 30 days)
EPSS percentile: 62.07% vs all CVEs — higher = more likely to be exploited, as of 2026-09-25

Affected products (2)

Vendor	Product	Versions	Platforms
Netgate	pfSense Plus	`0` (affected)	FreeBSD
Netgate	pfSense CE	`0` (affected)	FreeBSD

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

https://redmine.pfsense.org/issues/16947 issue-trackingtechnical-description
https://docs.netgate.com/downloads/pfSense-SA-26_18.webgui.asc vendor-advisory
https://redmine.pfsense.org/attachments/7146 patch
https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html mitigation

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://docs.netgate.com/downloads/pfSense-SA-26_18.webgui.asc cve@mitre.org
https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html cve@mitre.org
https://redmine.pfsense.org/attachments/7146 cve@mitre.org
https://redmine.pfsense.org/issues/16947 cve@mitre.org

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-97730.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "webgui (Dashboard widget layout)"
          ],
          "platforms": [
            "FreeBSD"
          ],
          "product": "pfSense Plus",
          "programFiles": [
            "index.php"
          ],
          "vendor": "Netgate",
          "versions": [
            {
              "lessThan": "26.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "webgui"
          ],
          "platforms": [
            "FreeBSD"
          ],
          "product": "pfSense CE",
          "programFiles": [
            "index.php"
          ],
          "vendor": "Netgate",
          "versions": [
            {
              "lessThan": "2.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-24",
              "description": "CWE-24 Path Traversal: '../filedir'",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T02:43:13.541Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "issue-tracking",
            "technical-description"
          ],
          "url": "https://redmine.pfsense.org/issues/16947"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.netgate.com/downloads/pfSense-SA-26_18.webgui.asc"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://redmine.pfsense.org/attachments/7146"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-97730",
    "datePublished": "2026-09-25T02:43:13.541Z",
    "dateReserved": "2026-09-25T02:43:12.840Z",
    "dateUpdated": "2026-09-25T02:43:13.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}