Executive brief
LibreNMS is a network monitoring platform that polls network devices via SNMP and collects syslog messages. Legacy PHP template files in LibreNMS fail to escape SNMP-sourced data (interface descriptions, sensor names) and syslog program fields before displaying them to authenticated users. An attacker controlling a monitored network device can inject malicious JavaScript that steals session cookies or performs unauthorized actions when any authenticated user views affected pages (alerts, health dashboards, syslog viewer).
Technical details
LibreNMS stores network device telemetry (interface descriptions, memory pool descriptions, sensor names from SNMP) and syslog messages in a database. Multiple legacy PHP template files (print-syslog.inc.php, functions.inc.php, health pages, pseudowires.inc.php, vrf.inc.php) output these values directly into HTML without HTML-entity encoding. The vulnerability is stored XSS: an attacker controlling a monitored SNMP device or syslog source can embed JavaScript payloads in interface descriptions or syslog program fields. When any authenticated LibreNMS user views affected pages (alerts, health dashboards, syslog viewer), the JavaScript executes in their browser with access to their session credentials. Newer Blade templates properly escape output; the issue is confined to legacy includes/html/ PHP files. Patch: upgrade to version 26.3.1 or later.
Affected products
- LibreNMS LibreNMS before 26.3.1
Timeline
- 2026-09-01: disclosed
- 2026-06-15: advisory: GitHub Security Advisory GHSA-7w8c-qgxg-m7jx published