CVE-2025-53392

MEDIUM

pfSense 2.8.0 - Authenticated Absolute Path Traversal via diag_command.php dlPath Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-53392. PoCs published by skraft9.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2025-53392, an authenticated arbitrary file read vulnerability in pfSense 2.8.0. It includes a proof-of-concept exploit demonstrating how a low-privileged user can exfiltrate sensitive files via the diagnostics interface.

Description

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.

Exploits (1)

nomisec WRITEUP 14 stars
by skraft9 · poc
https://github.com/skraft9/pfsense-security-research

This repository provides a detailed technical analysis of CVE-2025-53392, an authenticated arbitrary file read vulnerability in pfSense 2.8.0. It includes a proof-of-concept exploit demonstrating how a low-privileged user can exfiltrate sensitive files via the diagnostics interface.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: pfSense CE 2.8.0
Auth required
Prerequisites: Authenticated access to pfSense web interface · User assigned 'WebCfg - Diagnostics: Command' privilege
devstral-2 · analyzed May 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 5.0
EPSS 0.0177
EPSS Percentile 75.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-36
Status published
Products (1)
pfsense/pfsense 2.8.0
Published Jun 28, 2025
Tracked Since Feb 18, 2026