pfSense

Multiple fields on services_dhcp.php and services_dhcp_edit.php accept CR/LF characters, and other characters which are not valid for their content (e.g. '"', ';', '{', '}'), which can allow a user to add arbitrary configuration directives.

Affected fields are, at a minimum, the following on both services_dhcp.php and services_dhcp_edit.php: filename, rootpath, filename32, filename64, filename32arm, filename64arm, and uefihttpboot

This appears to be limited to configuration manipulation. The ISC DHCP Daemon runs in a chroot environment and does not have access to a full system environment, so it is unable to execute any commands.