File Inclusion Vulnerability in pfSense by Netgate
CVE-2019-16915

9.8CRITICAL

Key Information:

Vendor: Netgate
Status: Pfsense
Vendor: CVE Published:; 26 September 2019

What is CVE-2019-16915?

A security flaw has been identified in pfSense versions up to 2.4.4-p3, where the widgetkey parameter is passed directly to functions like file_get_contents and file_put_contents without proper sanitization. This oversight allows an attacker to potentially manipulate file paths, leading to unauthorized access to sensitive files on the system.