CVE-2026-111222
Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
Netgate pfSense CE
CVSS
7.5HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 21 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.96%Chance of exploitation activity in the next 30 days, higher than 61% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.
Text from CVE List
Affected versions 1
- pfSense CEaffected: all versions through 2.9.0CVE List
References 7
- vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-php-ini-injection-via-timezone-settingAdvisoryvia CVE List
- github.com/abraxas/pfsense-timezone-phpiniExploitvia CVE List
- abraxaslabs.tech/research/pfsense-ce-leftoversReferencevia CVE List
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/system.php#L288Referencevia CVE List
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/system.inc#L2377-L2380Referencevia CVE List
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/rc.php_ini_setup#L163-L166Referencevia CVE List
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/rc.php_ini_setup#L220Referencevia CVE List