LibreNMS stored XSS in graph description settings

Executive brief

LibreNMS is a network monitoring platform used to track and display device metrics. An administrator can store malicious JavaScript code in graph description settings, which executes in every authenticated user's browser when they view those graphs. This allows an attacker with admin access to compromise other users' sessions and steal their data.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in includes/html/pages/graphs.inc.php at line 194, where graph description settings from the `graph_descr.<graphtype>` configuration family are output directly to the page without HTML escaping via htmlspecialchars(). An admin can inject arbitrary HTML/JavaScript via the `/settings/graph_descr.<type>` endpoint; the payload persists in configuration storage and executes in the browser of every authenticated user who views that graph type. The attack requires prior admin credentials, but impacts all users viewing affected graphs. The vulnerability has been patched in version 26.7.0 with the application of htmlspecialchars() with ENT_QUOTES and UTF-8 encoding.

Affected products

• LibreNMS LibreNMS < 26.7.0

Timeline

• 2026-08-18: disclosed
• 2026-08-04: patched: Version 26.7.0 released with fix

References

• https://api.github.com/users/k1bana
• https://github.com/k1bana
• https://api.github.com/users/k1bana/gists%7B/gist_id%7D
• https://api.github.com/users/k1bana/repos
• https://avatars.githubusercontent.com/u/61563358?v=4
• https://api.github.com/users/k1bana/events%7B/privacy%7D