High severity7.2NVD Advisory· Published Oct 15, 2026· Updated Oct 15, 2026
CVE-2026-111218
CVE-2026-111218
Description
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Affected products
2- Range: 2.7.0 through 2.9.0
Patches
Vulnerability mechanics
References
5- abraxaslabs.tech/research/pfsense-ce-leftoversnvd
- abraxaslabs.tech/research/pfsense-limiter-numbernvd
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.incnvd
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.incnvd
- www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injection-via-traffic-shaper-limitersnvd
News mentions
0No linked articles in our index yet.