Directory Traversal Vulnerability in pfSense Snort Package

CVE-2025-34173

What is CVE-2025-34173?

A vulnerability exists in the pfSense CE Snort package where the iplist parameter is not adequately sanitized for directory traversal characters. This issue allows an authenticated attacker with 'WebCfg - Services: Snort package' permissions to determine if specific files exist on the server. While the contents of these files are protected, the ability to confirm their existence poses a security risk by enabling potential attackers to enumerate files within the system.

References