Cross-site scripting in LibreNMS - #VU140843
Published: August 4, 2026
Vulnerability identifier: #VU140843
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in an administrator's browser and disclose sensitive information.
The vulnerability exists due to cross-site scripting in legacy PHP template pages under includes/html/pages/ when rendering SNMP-sourced data without HTML escaping. A remote privileged user can inject crafted SNMP field values to execute arbitrary JavaScript in an administrator's browser and disclose sensitive information.
User interaction is required because an administrator must view an affected page. The issue was confirmed with exfiltration of SNMP community strings and CSRF tokens from the administrator's browser.
Affected software
LibreNMS
Remediation
Install security update from vendor's website.
LibreNMS - update to 26.3.0