Executive brief
LibreNMS, a popular network monitoring tool, is vulnerable to a security flaw where malicious code can be injected into the application's page titles. An attacker could trick an authenticated user into clicking a specially crafted link, allowing the attacker to execute unauthorized scripts in the user's browser. This could lead to the theft of session cookies or other sensitive information handled within the monitoring dashboard.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in LibreNMS within the Proxmox application integration. The root cause is located in `LegacyController.php`, which uses string interpolation to write the page title into a `document.title` JavaScript assignment without proper encoding. Specifically, the `instance` and `vmid` GET parameters in `apps/proxmox.inc.php` are only passed through `strip_tags()`, allowing an attacker to use a single quote to terminate the JS string and execute arbitrary code. Exploitation requires an authenticated session and user interaction (clicking a crafted link). The vulnerability is patched in version 26.5.0 by using `json_encode()` for the title assignment and `htmlspecialchars()` for the parameters.
Affected products
- LibreNMS LibreNMS <= 26.4.0
Timeline
- 2026-08-04: disclosed: Initial disclosure to vendor
- 2026-08-12: advisory: GitHub Advisory published
- 2026-08-12: patched: Fixed in version 26.5.0