DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-7W8C-QGXG-M7JX: GHSA-7W8C-QGXG-M7JX: Stored Cross-Site Scripting in LibreNMS Legacy Templates

#security #cve #cybersecurity #ghsa

GHSA-7W8C-QGXG-M7JX: Stored Cross-Site Scripting in LibreNMS Legacy Templates

Vulnerability ID: GHSA-7W8C-QGXG-M7JX
CVSS Score: 8.0
Published: 2026-08-26

A Stored Cross-Site Scripting (XSS) vulnerability exists within the legacy presentation templates of the LibreNMS network monitoring system. Due to inadequate context-aware output encoding of operational data ingested via Simple Network Management Protocol (SNMP) polling, Border Gateway Protocol (BGP) notifications, and incoming Syslog messages, an administrative user viewing device dashboards can be targeted with arbitrary JavaScript execution.

TL;DR

Insecure rendering of ingested network telemetry (SNMP, Syslog, BGP attributes) in legacy PHP view templates of LibreNMS allows the injection of persistent malicious scripts, leading to administrative session compromise.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network (Adjacent/Remote via SNMP/Syslog)
  • CVSS v3.1 Score: 8.0
  • EPSS Score: N/A
  • Impact: Stored Cross-Site Scripting (XSS)
  • Exploit Status: Proof-of-Concept Verification
  • KEV Status: Not Listed

Affected Systems

  • LibreNMS Network Monitoring System
  • LibreNMS: < 26.5.0 (Fixed in: 26.5.0)

Code Analysis

Commit: 6782af9

Various XSS fixes (#19660)

Exploit Details

  • Manual: Verification payload embedded in templates: sensor_descr .= 'alert(&quot;hello&quot;)'

Mitigation Strategies

  • Upgrade LibreNMS to version 26.5.0, 26.8.1, or higher immediately.
  • Implement a strong Content Security Policy (CSP) to restrict inline script execution and unauthorized outbound requests.
  • Restrict UDP port 514 (Syslog) and SNMP polling access to trusted internal IP ranges or VPN segments.
  • Audit active SNMP device inventories to ensure only authorized hosts are monitored.

Remediation Steps:

  1. Execute './daily.sh' via the command line to verify the current LibreNMS version.
  2. Perform a full system upgrade to apply security patches across legacy PHP templates.
  3. Inspect the nginx or Apache configuration to ensure Content Security Policy headers are enabled.
  4. Manually apply modifications to files identified in the patch diff if automated updates are unavailable.

References

Read the full report for GHSA-7W8C-QGXG-M7JX on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)