CVE-2026-55182
HighCVSS 8.6Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
LibreNMS versions from 21.6.0 up to 26.5.0 are vulnerable to command injection in the Signal alert transport because the signal-cli path and the Recipient field are insufficiently escaped before being passed to an exec call. An authenticated administrator can execute arbitrary OS commands on the LibreNMS host.
Risk Assessment
Risk of full host compromise by an administrator, potentially leading to confidentiality, integrity, and availability breaches.
Recommendation
Upgrade LibreNMS to version 26.5.0 or later, which includes the fix.
Other vulnerabilities in LibreNMS
See all- CVE-2020-15878Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajax_table.php API endpoint.
- CVE-2020-15876Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajax_table.php API endpoint. This affects many files in includes/html/table.
- CVE-2020-15874Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint.
- CVE-2024-51092Critical
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().
- CVE-2026-45694Medium
LibreNMS up to version 26.4.0 is vulnerable to reflected cross-site scripting in the Proxmox application view through user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. This issue is fixed in version 26.5.0.
- CVE-2026-80214High
LibreNMS's Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
Original NVD description (English source)
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.