GHSA-7cj5-v4pp-v632: Stored Cross-Site Scripting in LibreNMS Graph Descriptions
Vulnerability ID: GHSA-7CJ5-V4PP-V632
CVSS Score: 4.8
Published: 2026-08-18
LibreNMS versions prior to 26.7.0 are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. An authenticated administrator can inject arbitrary HTML or JavaScript into graph descriptions via specific administrative configuration endpoints. When another authenticated user views the affected graph, the unescaped payload executes within their browser context.
TL;DR
An authenticated administrator can store arbitrary JavaScript in the configuration database via graph descriptions. The stored payload executes inside the browser session of any user viewing the associated graph pages.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network
- CVSS v3.1 Score: 4.8
- Privileges Required: High
- User Interaction: Required
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- LibreNMS prior to version 26.7.0
-
librenms/librenms: < 26.7.0 (Fixed in:
26.7.0)
Exploit Details
- GitHub Security Advisory: Advisory containing the Proof of Concept payload details and endpoints.
Mitigation Strategies
- Upgrade LibreNMS to version 26.7.0 or higher.
- Apply manual source code hotfix using htmlspecialchars() on the vulnerable echo statement.
- Enforce a strict Content Security Policy (CSP) that restricts inline script execution.
- Implement the HttpOnly flag on all session cookies to prevent access via JavaScript.
Remediation Steps:
- Navigate to the LibreNMS installation directory.
- Open the file 'includes/html/pages/graphs.inc.php' in an editor.
- Locate line 194: echo LibrenmsConfig::get('graph_descr.' . $vars['type']);
- Replace it with: echo htmlspecialchars(LibrenmsConfig::get('graph_descr.' . $vars['type']), ENT_QUOTES, 'UTF-8');
- Save the file and restart the web server to clear any PHP caches.
References
Read the full report for GHSA-7CJ5-V4PP-V632 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)