# CVE-2026-6204: LibreNMS remote code execution in Binary Locations config

Source: https://junglewise.ai/threats/cve-2026-6204-librenms-remote-code-execution-in-binary-locations-config  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-6204 · Severity: high · CVSS 7.2 · Published 2026-04-13

LibreNMS, a popular network monitoring system, contains a vulnerability that allows an administrator to execute arbitrary commands on the underlying server. By manipulating the configuration for network diagnostic tools, a malicious user with administrative access can download and run unauthorized scripts. This could lead to a full system takeover, data theft, or further attacks on the internal network.

Technologies: [Librenms](https://junglewise.ai/threats/technologies/librenms), [librenms/librenms (Packagist)](https://junglewise.ai/threats/technologies/librenms-librenms). Vendors: [Librenms](https://junglewise.ai/threats/vendors/librenms), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-6204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6204 being exploited in the wild.

**How severe is CVE-2026-6204?** High severity, with a CVSS score of 7.2, published 13 April 2026.

**Which products and versions are affected?** Librenms >= 1.48, < 26.3.0; librenms/librenms (Packagist) >= 1.48, < 26.3.0, ECOSYSTEM:introduced=1.48,fixed=26.3.0.

**Is there a fix for CVE-2026-6204?** Yes. librenms/librenms (Packagist): upgrade to 26.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6204 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-6204?** Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- librenms/librenms (Packagist): upgrade to 26.3.0 or later

  ```sh
  composer require librenms/librenms:^26.3.0
  ```


## Technical details

An OS command injection vulnerability exists in LibreNMS due to insufficient validation of binary paths for network diagnostic tools. Authenticated administrators can modify absolute binary paths at '/settings/external/binaries' to point to arbitrary system executables like 'wget' or 'bash'. By bypassing an input filter on the 'GET /ajax/netcmd' endpoint, an attacker can first download a malicious script and subsequently execute it. This allows for full remote code execution (RCE) on the host server. The issue is addressed in version 26.3.0 by restricting binary path configurations.

## Affected products

- LibreNMS LibreNMS >= 1.48, < 26.3.0

## Identifiers

- CVE-2026-6204
- GHSA-pr3g-phhr-h8fh

## Timeline

- 2026-03-24: disclosed
- 2026-03-26: advisory
- 2026-03-26: patched: Version 26.3.0 released

## References

- [https://api.github.com/users/YuriNek0](https://api.github.com/users/YuriNek0)
- [https://github.com/YuriNek0](https://github.com/YuriNek0)
- [https://api.github.com/users/YuriNek0/gists%7B/gist_id%7D](https://api.github.com/users/YuriNek0/gists%7B/gist_id%7D)
- [https://api.github.com/users/YuriNek0/repos](https://api.github.com/users/YuriNek0/repos)
- [https://avatars.githubusercontent.com/u/23434411?v=4](https://avatars.githubusercontent.com/u/23434411?v=4)
- [https://api.github.com/users/YuriNek0/events%7B/privacy%7D](https://api.github.com/users/YuriNek0/events%7B/privacy%7D)

## Related threats

- [LibreNMS LDAP filter injection in external authorization modes](https://junglewise.ai/threats/cve-2026-109357-librenms-before-26-9-0-contains-an-ldap-filter-injection-in-ldap)
- [LibreNMS missing authorization in PortsController::purge](https://junglewise.ai/threats/cve-2026-109356-librenms-before-26-9-0-contains-a-missing-authorization)
- [LibreNMS stored cross-site scripting in Oxidized node list](https://junglewise.ai/threats/cve-2026-109355-librenms-before-26-9-0-contains-a-stored-cross-site-scripting)
- [LibreNMS path traversal in NFSen channel parameter](https://junglewise.ai/threats/cve-2026-109354-librenms-before-26-9-0-contains-a-path-traversal-vulnerability)
- [LibreNMS SQL injection in notifications.inc.php](https://junglewise.ai/threats/cve-2026-109353-librenms-before-26-9-0-contains-an-sql-injection-vulnerability)