Executive brief
LibreNMS is a network monitoring and management platform that generates performance graphs using the rrdtool utility. An authenticated attacker can inject malicious commands through the graph_title parameter to break out of quote escaping, allowing them to read monitoring data from any device regardless of permission restrictions, or tamper with historical data by executing arbitrary rrdtool commands.
Technical details
The vulnerability is a command injection flaw in the graph_title query parameter passed to rrdtool. The application only strips single quotes but fails to sanitize double quotes, which are the actual quoting mechanism used when serializing rrdtool command options. An authenticated attacker can inject a double quote to break out of the title argument's quoting boundary and inject arbitrary rrdtool graph arguments (DEF, CDEF, LINE). Additionally, URL-encoded newlines (%0a) allow execution of entirely separate rrdtool commands via stdin. The per-device authorization check validates access based on the URL path but does not inspect injected rrdtool options for unauthorized file references, allowing attackers to read RRD files from any device by specifying absolute paths. The vulnerability is patched in version 26.8.0.
Affected products
- LibreNMS LibreNMS before 26.8.0
Timeline
- 2026-08-23: disclosed
- 2026-09-07: advisory
- 2026: patched: version 26.8.0