An authenticated user with the Firewall: Rules: Edit privilege can inject arbitrary JavaScript into the descr field of a firewall rule via firewall_rules_edit.php. The payload is stored in the system’s XML configuration using only backslash escaping and is rendered without encoding in the firewall log table displayed at /status_logs_filter.php. When a user with the Status: Logs: Firewall privilege views the affected log entries, the malicious script executes in their browser, potentially allowing session hijacking or other attacks.

The flaw is present in Netgate’s pfSense CE versions earlier than 2.9.0 and in pfSense Plus versions earlier than 26.07. The vulnerability affects the pfSense web GUI component firewall_rules_edit.php and the log rendering page status_logs_filter.php.

The CVSS score of 5.1 indicates medium severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. However, exploitation only requires an authenticated session with specific firewall privileges and access to the log viewer, making the attack likely possible for privileged insiders. As the script runs in the client’s browser, the immediate impact is on the victim’s session and possibly on the network through console commands if the attacker can execute arbitrary code. The risk is moderate for environments where firewall rule editing and log viewing are combined under the same privilege scope.