Medium6.1Netgate pfSense

pfSense: In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly display…

CVE-2025-34175 Published Sep 9, 2025Updated by vendor Jun 17, 2026

CVE-2025-34175

Affected products & platforms

Netgate pfSenseUnclassified

Summary

In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated.

Mitigation

Mitigation steps weren't captured by the parser for this advisory — this is a parsing gap, not a statement that no fix exists. Read the vendor advisory below for the authoritative guidance.

Official advisory · medium-confidence parse· fetched 4 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.