CVE-2020-21219: Netgate Acme

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.

Affected products

• Netgate Acme: version 0.6.3 only
• Netgate Pfsense: version 2.4.4 only

Published 2022-12-15. Last modified 2026-06-17.