Executive brief
LibreNMS is a network monitoring and management platform used by organizations to track infrastructure health and send alerts. An authenticated administrator can inject malicious commands into alert transport configuration fields, leading to arbitrary code execution on the server. This allows an insider threat to compromise the entire monitoring infrastructure, access sensitive network data, or establish a foothold for further attacks.
Technical details
The vulnerability is a command injection flaw in the Signal alert transport module (LibreNMS/Alert/Transport/Signal.php) and the composer_wrapper.php script. The deliverAlert function constructs shell commands using unsafe exec() calls with insufficient escaping of user-supplied inputs, specifically the executable path and recipient fields. An authenticated administrator can chain these two vulnerable exec() calls by setting the path to ../scripts/composer_wrapper.php and injecting shell metacharacters (`;` delimiters) in the Recipient field to execute arbitrary commands. The vulnerability affects versions 21.6.0 through 26.4.x and is fixed in version 26.5.0. Authentication as an administrator is required to exploit this issue.
Affected products
- LibreNMS LibreNMS >=21.6.0, <26.5.0
Timeline
- 2026-08-18: disclosed: Advisory published
- 2026-06-10: patched: Fix released in version 26.5.0