DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-7GWW-X7FH-JF9J: GHSA-7GWW-X7FH-JF9J: SSRF-Driven Stored Cross-Site Scripting in LibreNMS Oxidized Integration

#security #cve #cybersecurity #ghsa

GHSA-7GWW-X7FH-JF9J: SSRF-Driven Stored Cross-Site Scripting in LibreNMS Oxidized Integration

Vulnerability ID: GHSA-7GWW-X7FH-JF9J
CVSS Score: 8.1
Published: 2026-08-18

An injection vulnerability in LibreNMS's Oxidized integration component allows administrative or network-positioned attackers to achieve stored cross-site scripting (XSS). By setting a malicious oxidized.url endpoint, the server makes outbound queries and processes returned JSON fields containing malicious HTML or JavaScript. These payloads are outputted directly in the web UI without appropriate output encoding.

TL;DR

A high-severity SSRF-driven Stored XSS vulnerability in LibreNMS prior to 26.7.0 allows attackers to execute arbitrary JavaScript in the user's browser via unescaped Oxidized configuration fields.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79 / CWE-918
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.1 (High)
  • EPSS Score: N/A
  • Impact: Stored Cross-Site Scripting (XSS) / Privilege Escalation
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not listed

Affected Systems

  • LibreNMS Network Monitoring System
  • LibreNMS: < 26.7.0 (Fixed in: 26.7.0)

Exploit Details

Mitigation Strategies

  • Upgrade LibreNMS to version 26.7.0 or later to apply context-aware HTML output sanitization.
  • Restrict write permissions to the 'oxidized.url' parameter in the administrative console.
  • Implement firewall rules restricting outbound connections from the LibreNMS host to unauthorized external networks.

Remediation Steps:

  1. Verify the current version of LibreNMS running in your environment.
  2. Navigate to the update utility or execute 'git pull' / 'composer install' to transition to version 26.7.0.
  3. Confirm that all Oxidized integration parameters ('oxidized.url') point only to verified, internal Oxidized endpoints.
  4. Verify that variables like 'name', 'ip', and 'model' are escaped correctly when accessing the showconfig tab.

References

Read the full report for GHSA-7GWW-X7FH-JF9J on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)