Executive brief
LibreNMS, an open-source network monitoring system, is vulnerable to a security flaw that allows an administrator to take full control of the underlying server. By manipulating settings intended for network diagnostic tools, a malicious user with high-level access can force the server to download and execute unauthorized scripts. This could lead to a complete system compromise, data theft, or a foothold for further attacks within the corporate network.
Technical details
LibreNMS versions prior to 26.3.0 contain an OS command injection vulnerability. The application allows administrative users to configure absolute binary paths for network diagnostic tools (like whois or ping) via the 'Binary Locations' settings. An attacker can modify these paths to point to other system binaries, such as 'wget' or 'bash'. By then invoking the '/ajax/netcmd' endpoint and bypassing the 'ip_or_hostname' input filter, the attacker can download a malicious script and subsequently execute it. This exploit requires administrative privileges but results in full remote code execution as the web server user. The issue is addressed in version 26.3.0.
Affected products
- LibreNMS LibreNMS >= 1.48, < 26.3.0
Timeline
- 2026-03-24: advisory: Original advisory GHSA-pr3g-phhr-h8fh published
- 2026-04-13: disclosed: CVE-2026-6204 published and duplicate advisory GHSA-7549-ggpq-22w8 created
- 2026-04-14: other: Duplicate advisory GHSA-7549-ggpq-22w8 withdrawn in favor of original