CVE-2025-53392CWE-36

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal

Medium · published June 28, 2025

CVSS v3.1
5.0
EPSS
2%
Percentile
78.9
In the wild
Unconfirmed
What it is

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01848 · 78.9th percentile
Weakness
CWE-36 · Absolute Path Traversal
Published
2025-06-28T00:00Z
EPSS history
Timeline
  • 28 JUN 00:00Z
    In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal
    cvelistv5