CVE-2026-111219 — Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated …
Published: 2026-10-15 · CVSS: 7.5 · CVSS 4.0
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7