---
id: CVE-2025-34176
title: "In pfSense CE\_/suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters"
summary: "In pfSense CE\_/suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents…"
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-22
vendor: pfsense
product: pfsense
affected:
  - pfsense < 2.8.0
patched:
  - pfsense 2.8.0
published: '2025-09-09'
updated: '2026-07-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-34176'
references:
  - url: >-
      https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4
    label: disclosure@vulncheck.com
  - url: 'https://redmine.pfsense.org/issues/16414'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-directory-traversal-information-disclosure
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.14966
epssPercentile: 0.9659
ingestedAt: '2026-07-15T13:44:03.120Z'
---

## Overview

In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.

## Affected

- `pfsense < 2.8.0`

## Remediation

Upgrade past the affected range:

- `pfsense 2.8.0`