Executive brief
LibreNMS is a network monitoring application that integrates with Oxidized, a configuration management system. An administrator can configure LibreNMS to fetch device data from an external Oxidized server. If an attacker can trick the administrator into pointing this URL to an attacker-controlled server, the attacker can inject malicious code that will execute in the browsers of all users who view device configuration pages, potentially allowing theft of session credentials or unauthorized actions on the monitoring system.
Technical details
LibreNMS contains a stored cross-site scripting (XSS) vulnerability in the device showconfig page. The vulnerability exists in the Oxidized integration code (includes/html/pages/device/showconfig.inc.php, lines 276–278 and others) which renders JSON fields (name, ip, model, author, commit message) from the admin-configurable Oxidized API without HTML escaping. An administrator pointing the oxidized.url setting at an attacker-controlled server allows the attacker to return malicious JSON payloads. Since the returned data is embedded directly into HTML output without htmlspecialchars(), any user viewing any device's showconfig tab will have the malicious script executed in their browser context. This requires high privileges (admin configuration access) but affects all regular users. The vulnerability was fixed in version 26.7.0 by applying htmlspecialchars() with ENT_QUOTES to all untrusted fields.
Affected products
- LibreNMS LibreNMS through 26.4.0
Timeline
- 2026-08-04: disclosed: GitHub Security Advisory GHSA-7gww-x7fh-jf9j published
- 2026-09-01: advisory: NVD entry published
- 2026-09-01: patched: Fixed in version 26.7.0