Executive brief
LibreNMS is a popular open-source network monitoring platform used to manage and monitor network devices and systems. This vulnerability allows authenticated administrators to execute arbitrary system commands by manipulating a configuration setting, potentially leading to complete compromise of the monitoring server and the ability to monitor or access connected network infrastructure. An attacker with admin credentials can create or point to a malicious executable file, which gets executed when the /about page is accessed, giving the attacker full control of the server.
Technical details
The vulnerability exists in app/Http/Controllers/AboutController.php (line 85), where the snmpget configuration value is directly concatenated into a shell_exec() call without safe argument passing. While the sanitizePath() function blocks direct command injection characters (;, `, #, $, |, &, ', ", >, <, (), it does not prevent an attacker from pointing the configuration to a pre-existing malicious executable file on the system. The vulnerable code is: shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'). The snmpget configuration can be modified via the web interface at PUT /settings/snmpget (SettingsController::update()) and requires administrator privileges. An authenticated admin can update the configuration to point to a malicious binary, and when the /about endpoint is accessed, the arbitrary executable is invoked with web server privileges. The fix involves replacing shell_exec() with the Symfony Process component to safely pass arguments as an array rather than string concatenation.
Affected products
- LibreNMS LibreNMS < 26.5.0
Timeline
- 2026-08-04: disclosed
- 2026-08-18: advisory
- 2026-08-18: patched: Fixed in version 26.5.0