GHSA-7W8C-QGXG-M7JX: Stored Cross-Site Scripting in LibreNMS Legacy Templates

Vulnerability ID: GHSA-7W8C-QGXG-M7JX
CVSS Score: 8.0
Published: 2026-08-26

A Stored Cross-Site Scripting (XSS) vulnerability exists within the legacy presentation templates of the LibreNMS network monitoring system. Due to inadequate context-aware output encoding of operational data ingested via Simple Network Management Protocol (SNMP) polling, Border Gateway Protocol (BGP) notifications, and incoming Syslog messages, an administrative user viewing device dashboards can be targeted with arbitrary JavaScript execution.

TL;DR

Insecure rendering of ingested network telemetry (SNMP, Syslog, BGP attributes) in legacy PHP view templates of LibreNMS allows the injection of persistent malicious scripts, leading to administrative session compromise.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network (Adjacent/Remote via SNMP/Syslog)
CVSS v3.1 Score: 8.0
EPSS Score: N/A
Impact: Stored Cross-Site Scripting (XSS)
Exploit Status: Proof-of-Concept Verification
KEV Status: Not Listed

Affected Systems

LibreNMS Network Monitoring System
LibreNMS: < 26.5.0 (Fixed in: 26.5.0)

Code Analysis

Commit: 6782af9

Various XSS fixes (#19660)

Exploit Details

Manual: Verification payload embedded in templates: sensor_descr .= 'alert("hello")'

Mitigation Strategies

Upgrade LibreNMS to version 26.5.0, 26.8.1, or higher immediately.
Implement a strong Content Security Policy (CSP) to restrict inline script execution and unauthorized outbound requests.
Restrict UDP port 514 (Syslog) and SNMP polling access to trusted internal IP ranges or VPN segments.
Audit active SNMP device inventories to ensure only authorized hosts are monitored.

Remediation Steps:

Execute './daily.sh' via the command line to verify the current LibreNMS version.
Perform a full system upgrade to apply security patches across legacy PHP templates.
Inspect the nginx or Apache configuration to ensure Content Security Policy headers are enabled.
Manually apply modifications to files identified in the patch diff if automated updates are unavailable.