SB2026080413 - Multiple vulnerabilities in LibreNMS
Published: August 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Command injection (CVE-ID: N/A)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to command injection in LibreNMS/OS/Traits/VminfoLibvirt.php when processing administrator-controlled libvirt username or protocol settings during discovery jobs. A remote user can inject shell commands through the virtualization module configuration to execute arbitrary code.
Exploitation requires administrative access to modify the relevant settings, and the injected commands are triggered when a poller starts a discovery job.
2) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to write arbitrary files and execute arbitrary code.
The vulnerability exists due to improper input validation in LibreNMS/OS/Traits/VminfoLibvirt.php when using an administrator-controlled virsh binary path during discovery jobs. A remote user can set the virsh path to another executable and supply crafted configuration values to write arbitrary files and execute arbitrary code.
Exploitation requires administrative access to change binary location settings, and code execution may depend on hosting a malicious device or otherwise making a payload reachable to the server.
Remediation
Install update from vendor's website.