CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
Authenticated users with Traffic Shaper privileges can execute root commands via OS command injection in the limiter number field.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111218?
CVE-2026-111218 is a high-severity command injection vulnerability in Netgate pfSense CE, published on 15 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Weakness: CWE-78
Which versions are affected by CVE-2026-111218?
It affects 1 product.
Products include Pfsense Pfsense.
How do I fix CVE-2026-111218?
No fix has been published for CVE-2026-111218 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-111218 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111218 exists.
Other vulnerabilities in Netgate pfSense CE
Sources
Also known as GHSA-224g-fpr5-96gw.