CVE-2026-45694
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
LibreNMS up to version 26.4.0 is vulnerable to reflected cross-site scripting in the Proxmox application view through user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. This issue is fixed in version 26.5.0.
Risk Assessment
An attacker can lure an authenticated user into following a crafted link, enabling script execution in the user's session, such as theft of session data.
Recommendation
Upgrade LibreNMS to version 26.5.0 or later and educate users about clicking unknown links.
Other vulnerabilities in LibreNMS
See all- CVE-2020-15878Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajax_table.php API endpoint.
- CVE-2020-15876Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajax_table.php API endpoint. This affects many files in includes/html/table.
- CVE-2020-15874Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint.
- CVE-2024-51092Critical
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().
- CVE-2026-55182High
LibreNMS versions from 21.6.0 up to 26.5.0 are vulnerable to command injection in the Signal alert transport because the signal-cli path and the Recipient field are insufficiently escaped before being passed to an exec call. An authenticated administrator can execute arbitrary OS commands on the LibreNMS host.
- CVE-2026-80214High
LibreNMS's Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
Original NVD description (English source)
LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The parameters are placed into the page title with only strip_tags applied, and the title is then written into an inline document.title assignment through string interpolation, so a single quote terminates the JavaScript string and the remaining input runs as script. An attacker who lures an authenticated user into following a crafted link can execute script in that user's session, enabling actions such as theft of session data. This issue is fixed in version 26.5.0.