CVE-2026-111219

Netgate pfSense CE versions through 2.9.0 are vulnerable to a command injection flaw located in services_pppoe_edit.php. The issue stems from a newline injection vulnerability where the application fails to validate username POST fields . A user with PPPoE Server Edit privileges can inject entrie...

CVE-2026-111219 Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in servicespppoeedit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making...