Description

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields that executes when authenticated users view affected pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-01T12:17:48.723Z",
  "pubdate": "2026-09-01T12:17:48.723Z",
  "executiveSummary": "LibreNMS versions prior to 26.3.1 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability residing within legacy PHP templates. This security flaw allows for the injection of arbitrary JavaScript via SNMP interface descriptions or syslog program fields. An attacker who has the capability to influence the data retrieved from a monitored network device can successfully inject malicious scripts that execute within the browser context of an authenticated LibreNMS user. The vulnerability stems from the application's failure to properly sanitize or encode data sourced from external network elements before rendering it in the user interface. Successful exploitation results in the unauthorized execution of script code within the victim's session, potentially leading to session hijacking, unauthorized administrative actions, or the exfiltration of sensitive monitoring data. Because this is a stored XSS vulnerability, the payload remains persistent within the LibreNMS database, ensuring execution every time an affected dashboard or report page is accessed. The risk is significant, as it effectively bridges the gap between an untrusted network device and the privileged internal management interface of the network monitoring system.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS) occurring due to the absence of output encoding in legacy PHP templates within the LibreNMS framework. The root cause is the direct rendering of SNMP-sourced data (specifically interface descriptions) and syslog-sourced data (specifically program fields) into the HTML document object model (DOM) without applying appropriate escaping or sanitization functions.\nThe attack flow begins when an attacker gains control over a monitored network device or compromises a device that is currently configured to send logs or SNMP updates to the LibreNMS instance. By modifying the SNMP interface description or the syslog program metadata, the attacker can insert a malicious payload consisting of HTML tags and JavaScript (e.g., <script>alert(document.cookie)</script>).\nWhen the LibreNMS daemon processes the incoming SNMP traps or syslog messages, it stores these raw, malicious strings into the underlying database. The vulnerability manifests when an authenticated user navigates to a web page that fetches and displays this stored data. Because the PHP templates fail to use context-aware output encoding (such as htmlspecialchars or a template engine's automatic escaping), the browser interprets the injected payload as executable code rather than plain text.\nThe exploitation requirements are relatively low; the attacker needs the ability to communicate with the LibreNMS server via SNMP or syslog protocols. Authentication is not required for the initial payload injection, as the malicious data is ingested by the system as part of normal monitoring operations. However, the execution of the payload is triggered within the session of an authenticated LibreNMS user viewing the management interface. The impact of such an exploit includes the ability of an attacker to execute arbitrary actions in the context of the authenticated user's session, potentially enabling full compromise of the LibreNMS instance, redirection to malicious domains, or the theft of session cookies and sensitive management configurations.\nAffected versions are identified as all LibreNMS releases prior to 26.3.1. The vulnerable components are the legacy PHP templates that process and display SNMP and syslog telemetry data. As the payload is stored persistently in the database, the execution persists until the malicious entries are cleared from the database or the template output is hardened to properly encode character streams before rendering."
}