An authenticated attacker who can modify the firewall’s dashboard settings can exploit a local file inclusion flaw in the Dashboard (index.php) widget sequence handling to execute arbitrary PHP code. The attacker inserts a path-traversal payload into the widget sequence and, having the ability to write an arbitrary file to a writable location such as /tmp, forces the dashboard to include and run that file as a native widget, effectively granting full code execution on the device. This is a classic insecure file path handling vulnerability (CWE‑24) that allows any attacker with local privileges to run code with firewall privileges.

The affected products are Netgate pfSense CE versions prior to 2.9.0 and Netgate pfSense Plus versions prior to 26.07. The flaw resides in the Dashboard widget configuration module of these installations.

The CVSS score of 8.5 indicates high severity. The EPSS score of 0.01025 points to a very low but non‑zero probability of exploitation, and the issue is not listed in CISA’s KEV catalog. The exploit requires local authentication and the ability to modify dashboard settings and write arbitrary files to the system, such as /tmp. If successful, an attacker can execute arbitrary PHP code with firewall privileges, potentially compromising the device and the network it protects.