# CVE-2025-65013: LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`

Source: https://junglewise.ai/threats/cve-2025-65013-librenms-vulnerable-to-reflected-cross-site-scripting-xss-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18  
License: CC BY 4.0 with a link back

CVE-2025-65013 · Severity: medium · CVSS 6.2 · Published 2025-11-18

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without proper output encoding or sanitization, allowing an attacker to craft a URL that, when visited by a victim, causes arbitrary JavaScript execution in the victim’s browser. This issue has been patched in version 25.11.0.

Technologies: [Librenms](https://junglewise.ai/threats/technologies/librenms), [librenms/librenms (Packagist)](https://junglewise.ai/threats/technologies/librenms-librenms). Vendors: [Librenms](https://junglewise.ai/threats/vendors/librenms), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2025-65013 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-65013 being exploited in the wild.

**How severe is CVE-2025-65013?** Medium severity, with a CVSS score of 6.2, published 18 November 2025.

**Which products and versions are affected?** librenms/librenms (Packagist) ECOSYSTEM:introduced=0,fixed=25.11.0.

**Is there a fix for CVE-2025-65013?** Yes. librenms/librenms (Packagist): upgrade to 25.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-65013?** Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- librenms/librenms (Packagist): upgrade to 25.11.0 or later

  ```sh
  composer require librenms/librenms:^25.11.0
  ```


## Affected products

- Librenms
- librenms/librenms (Packagist) ECOSYSTEM:introduced=0,fixed=25.11.0

## Identifiers

- CVE-2025-65013
- GHSA-j8cq-7f6p-256x

## Related threats

- [LibreNMS LDAP filter injection in external authorization modes](https://junglewise.ai/threats/cve-2026-109357-librenms-before-26-9-0-contains-an-ldap-filter-injection-in-ldap)
- [LibreNMS missing authorization in PortsController::purge](https://junglewise.ai/threats/cve-2026-109356-librenms-before-26-9-0-contains-a-missing-authorization)
- [LibreNMS stored cross-site scripting in Oxidized node list](https://junglewise.ai/threats/cve-2026-109355-librenms-before-26-9-0-contains-a-stored-cross-site-scripting)
- [LibreNMS path traversal in NFSen channel parameter](https://junglewise.ai/threats/cve-2026-109354-librenms-before-26-9-0-contains-a-path-traversal-vulnerability)
- [LibreNMS SQL injection in notifications.inc.php](https://junglewise.ai/threats/cve-2026-109353-librenms-before-26-9-0-contains-an-sql-injection-vulnerability)