skraft9/pfsense-security-research
GitHub
Releases0
Stars14
Authenticated Arbitrary File Read in pfSense 2.8.0 via Diagnostics Web Interface (CVE-2025-53392)
CVE History
| CVE | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|
| 5 MEDIUM | — | ||
In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI. | |||