Executive brief
LibreNMS is a network monitoring and graphing platform used by organizations to track infrastructure performance. A vulnerability allows administrators to inject malicious HTML code into graph description configuration settings, which then executes in the browsers of all authenticated users viewing those graphs. This could lead to session hijacking, credential theft, or other unauthorized actions performed on behalf of legitimate users.
Technical details
LibreNMS contains a stored cross-site scripting (XSS) vulnerability in the graph_descr.<graphtype> configuration settings. The vulnerable code in includes/html/pages/graphs.inc.php echoes the configuration value directly without HTML entity escaping using htmlspecialchars(). An authenticated administrator can store a malicious HTML/JavaScript payload via a PUT request to /settings/graph_descr.<graphtype>. When any authenticated user views the affected graph type, the payload executes in their browser with the privileges of that user. The vulnerability requires administrative privileges to inject the payload and user interaction (visiting the affected graph), but affects the security scope of all authenticated users. The fix, available in version 26.7.0, applies htmlspecialchars() with ENT_QUOTES encoding to neutralize the payload.
Affected products
- LibreNMS LibreNMS <=26.4.0
Timeline
- 2026-09-01: disclosed
- 2026: patched: Version 26.7.0