SB2026042417 - Multiple vulnerabilities in LibreNMS

Description

This security bulletin contains information about 3 vulnerabilities.

1) OS Command Injection (CVE-ID: CVE-2026-6204)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in an os command in the binary path settings and /ajax/netcmd endpoint when handling crafted network tool configuration and requests. A remote user can modify configured binary paths and send a crafted request to execute arbitrary code.

Exploitation requires administrative access to the application and the ability for the server to reach a remote host to download a payload.

2) Cross-site scripting (CVE-ID: CVE-2026-2728)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary script code in a victim's browser.

The vulnerability exists due to cross-site scripting in the ShowConfig page when rendering the rancid_repo_url configuration value in an HTML anchor tag. A remote privileged user can inject a crafted configuration value to execute arbitrary script code in a victim's browser.

User interaction is required when a user visits the affected device configuration page.

3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary JavaScript in an administrator's browser and disclose sensitive information.

The vulnerability exists due to cross-site scripting in legacy PHP template pages under includes/html/pages/ when rendering SNMP-sourced data without HTML escaping. A remote privileged user can inject crafted SNMP field values to execute arbitrary JavaScript in an administrator's browser and disclose sensitive information.

User interaction is required because an administrator must view an affected page. The issue was confirmed with exfiltration of SNMP community strings and CSRF tokens from the administrator's browser.

Remediation

Install update from vendor's website.

References

• https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fh
• https://github.com/advisories/GHSA-pr3g-phhr-h8fh
• https://github.com/librenms/librenms/security/advisories/GHSA-5gm9-622f-qcg5
• https://github.com/librenms/librenms/security/advisories/GHSA-v5jp-f342-234h