CVE-2026-111230

MEDIUM 4.9

Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL

CVSS Score

4.9

EPSS Score

0.0%

EPSS Percentile

0th

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.

CWE	CWE-73
Vendor	netgate
Product	pfsense ce
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for netgate pfsense ce

Be the first to know when new medium vulnerabilities affecting netgate pfsense ce are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Netgate / pfSense CE

0 ≤ 2.9.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/abraxas/pfsense-dyndns-file abraxaslabs.tech: https://abraxaslabs.tech/research/pfsense-ce-leftovers github.com: https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/dyndns.class#L598-L616 github.com: https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/dyndns.class#L2151-L2171 github.com: https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_dyndns_edit.php#L138-L141 vulncheck.com: https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-local-file-read-via-dynamic-dns-update-url

Credits

Abraxas Labs