The vulnerability allows an authenticated user with General Setup privileges to inject arbitrary php.ini directives by providing an unvalidated timezone value. An attacker can embed quotes and newlines to append an auto_prepend_file directive that points to "/var/db/zoneinfo", which causes PHP to execute the file as the system root user after php.ini is regenerated at boot or during a php-fpm restart. This leads to remote code execution with full root privileges on the device.

Netgate pfSense Community Edition versions up to 2.9.0 are affected. No later releases are known to be impacted.

The CVSS score of 7.5 reflects a high severity. The EPSS score is not available, indicating no published data on exploitation frequency. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated user with General Setup rights; the attack vector is local to the web interface. An attacker can trigger the injection by submitting a specially crafted timezone value, leading to privilege escalation once php.ini is reloaded.