CVE-2026-111222 Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
Authenticated users with General Setup privileges can inject PHP directives via timezone settings to execute code as root.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111222?
CVE-2026-111222 is a high-severity code injection vulnerability in Netgate pfSense CE, published on 15 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.
Weakness: CWE-93
Which versions are affected by CVE-2026-111222?
It affects 1 product.
Products include Pfsense Pfsense.
How do I fix CVE-2026-111222?
No fix has been published for CVE-2026-111222 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-111222 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111222 exists.
Other vulnerabilities in Netgate pfSense CE
Sources
Also known as GHSA-3c6h-8mvp-vqx3.