Description

LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in version 26.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-01T12:17:48.143Z",
  "pubdate": "2026-09-01T12:17:48.143Z",
  "executiveSummary": "LibreNMS versions up to and including 26.4.0 are affected by a stored cross-site scripting (XSS) vulnerability residing within the graph_descr configuration settings.\nThe vulnerability allows an authenticated administrator to inject malicious HTML or JavaScript payloads into graph configuration parameters.\nWhen a victim, such as an administrator or authenticated user, views a graph associated with the modified configuration, the payload is executed within the context of the user's session.\nThis vulnerability poses a significant risk to the integrity of the management platform, potentially leading to unauthorized actions, session hijacking, or the exfiltration of sensitive monitoring data.\nExploitation requires administrative privileges to modify the graph description settings, which then impacts any authenticated user who accesses the compromised interface.\nThe vulnerability has been addressed in version 26.7.0, and immediate upgrades are recommended to prevent potential exploitation.",
  "technicalDetails": "The root cause of this vulnerability is the improper neutralization of user-supplied input within the graph_descr.<graphtype> configuration parameters. The application fails to perform adequate input sanitization or output encoding before rendering these values in the user interface.\nSpecifically, the file includes/html/pages/graphs.inc.php processes the graph description and reflects the stored configuration data directly into the HTML output without HTML entity escaping. This behavior permits an attacker to inject arbitrary HTML tags and malicious script blocks into the page structure.\nThe attack flow begins with an authenticated administrator navigating to the graph configuration settings within LibreNMS. By modifying the graph_descr parameter to include a crafted payload—such as a <script> tag or event handlers within HTML attributes—the attacker successfully stores the malicious code in the application's backend database.\nOnce the payload is persisted, it remains dormant until the affected graph is rendered by the web application for any authenticated user. When a user requests the graph page, the application retrieves the malicious string from the database and inserts it directly into the DOM (Document Object Model) of the response.\nUpon loading the page, the user's browser parses the malicious payload as legitimate HTML/JavaScript, executing the script within the origin of the LibreNMS web application. Because the script executes in the context of the user's browser, it gains access to the user's cookies, session tokens, and the ability to perform actions on behalf of the user within the LibreNMS interface.\nThis vulnerability is classified as stored XSS, as the payload is permanently stored on the server rather than being transient like a reflected XSS attack. The scope of the impact includes session hijacking, redirecting users to malicious external domains, or performing unauthorized administrative actions through automated API calls or form submissions orchestrated by the payload.\nThe vulnerability affects LibreNMS versions 26.4.0 and earlier. There is no requirement for network-level interception, as the primary vector relies on the application's internal data handling and rendering logic."
}