CVE-2025-34176: netgate pfsense ce Path Traversal

Vulnerability summary

CVE-2025-34176 is a medium (CVSS 5.3) Path Traversal vulnerability in netgate pfsense ce. EPSS estimates a 17.27% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities.

Timeline

1. 09-09-2025
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.