CVE-2025-34176

UNKNOWN 0.0

Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure

CVSS Score

0.0

EPSS Score

13.9%

EPSS Percentile

96th

In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.

CWE	CWE-22
Vendor	netgate
Product	pfsense ce
Published	Sep 9, 2025
Last Updated	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for netgate pfsense ce

Be the first to know when new unknown vulnerabilities affecting netgate pfsense ce are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Netgate / pfSense CE

7.0.8_2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 redmine.pfsense.org: https://redmine.pfsense.org/issues/16414 vulncheck.com: https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-directory-traversal-information-disclosure

Credits

Alex Williams (Pellera Technologies)