CVE-2025-53392

Published June 28th, 2025

View on NVD ↗

CVSS v3

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.

skraft9/pfsense-security-research

Authenticated Arbitrary File Read in pfSense 2.8.0 via Diagnostics Web Interface (CVE-2025-53392)

GitHub