Executive brief
LibreNMS is a network monitoring platform that collects data from SNMP-enabled devices and syslog sources. Multiple legacy PHP template files fail to escape SNMP interface descriptions and syslog message fields before displaying them in web pages, allowing an attacker who controls a monitored network device to inject malicious JavaScript. When authenticated users view alert pages, device health details, or syslog records, the injected code executes in their browsers and can steal session cookies or perform unauthorized actions.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in legacy PHP template files within LibreNMS. The root cause is the direct output of untrusted SNMP-sourced data (interface descriptions, pool descriptions, sensor descriptions) and syslog-sourced data (syslog program field) into HTML context without HTML entity encoding. Vulnerable code locations include includes/html/print-syslog.inc.php (syslog program field), includes/html/functions.inc.php (alert details with ifAlias and multiple other fields), and device health pages (mempool.inc.php, storage.inc.php, sensors.inc.php). An attacker who compromises a monitored SNMP agent or syslog sender can inject JavaScript payloads (e.g., `<img src=x onerror="fetch(...)">`) that are stored in the LibreNMS database and executed in the browsers of any authenticated user viewing the affected pages. No authentication is required to control a monitored device; attack preconditions are network access to an SNMP agent or syslog receiver. The vulnerability was patched in version 26.5.0 by adding htmlspecialchars() or equivalent escaping to all vulnerable output statements.
Affected products
- LibreNMS LibreNMS < 26.5.0
Timeline
- 2026-06-15: disclosed: Published to GitHub Advisory Database
- 2026-05-01: patched: Fixed in version 26.5.0