CVE-2026-111232

MEDIUM 4.8

Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color

CVSS Score

4.8

EPSS Score

0.0%

EPSS Percentile

0th

Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.

CWE	CWE-79
Vendor	netgate
Product	pfsense ce
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for netgate pfsense ce

Be the first to know when new medium vulnerabilities affecting netgate pfsense ce are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Netgate / pfSense CE

2.3.0 ≤ 2.9.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/abraxas/pfsense-separator-color-xss abraxaslabs.tech: https://abraxaslabs.tech/research/pfsense-ce-leftovers github.com: https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/filter.inc#L6238-L6252 github.com: https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L236-L245 vulncheck.com: https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.3.0-through-2.9.0-stored-xss-via-separator-color

Credits

Abraxas Labs