Reflected Cross-Site Scripting in pfSense CE by Netgate
CVE-2025-34175

5.1MEDIUM

Key Information:

Vendor

Netgate

Status
Pfsense Ce
Vendor
CVE Published:
9 September 2025

What is CVE-2025-34175?

In pfSense CE, the script located at /usr/local/www/suricata/suricata_filecheck.php fails to sanitize the 'filehash' parameter properly. This oversight allows attackers to inject HTML-related characters, leading to reflected cross-site scripting attacks when an authenticated user accesses the compromised content. Such vulnerabilities can undermine user trust and expose sensitive data.

Affected Version(s)

pfSense CE 7.0.8_2

References

https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd...
patch
https://redmine.pfsense.org/issues/16414
issue-tracking

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams (Pellera Technologies)
.