CVE-2026-111222

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add autoprependfile pointing at /var/db/zoneinfo,...

CVE-2026-111222

Netgate pfSense CE versions through 2.9.0 are vulnerable to a php.ini injection via the timezone setting. This flaw occurs because the system fails to validate the input provided for the timezone, allowing authenticated users with General Setup privileges to inject malicious directives. By embedd...