Description

LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-07T13:20:41.870Z",
  "pubdate": "2026-09-07T13:20:41.870Z",
  "executiveSummary": "LibreNMS versions prior to 26.8.0 are susceptible to an argument injection vulnerability residing within the graph_title parameter.\nThe flaw stems from insufficient sanitization of user-supplied input, enabling authenticated attackers to escape double-quote delimiters and inject arbitrary rrdtool arguments.\nThis vulnerability allows an attacker to manipulate the rrdtool execution process, leading to the unauthorized disclosure of sensitive data contained within RRD files from restricted devices.\nFurthermore, through newline injection, attackers can force the execution of arbitrary rrdtool commands, effectively bypassing established per-device authorization controls.\nSuccessful exploitation requires an authenticated session, posing a significant risk to organizations where internal users or compromised accounts may attempt to exfiltrate operational data or gain unauthorized insights into network monitoring configurations.\nThe vulnerability represents a critical failure in input validation when interfacing with backend system utilities.",
  "technicalDetails": "The vulnerability is located in the processing logic of the graph_title parameter within LibreNMS. When this parameter is passed to the underlying rrdtool utility, the application fails to adequately escape or sanitize the input, allowing for the subversion of the command-line structure.\nThe root cause is an improper neutralization of special characters that act as command delimiters or argument separators. Specifically, by providing a payload containing double quotes, an attacker can break out of the intended string context. This enables the injection of additional rrdtool flags, such as DEF (Data Definition) or LINE, which alter the tool's intended data retrieval path.\nThe exploitation flow typically begins with an authenticated attacker interacting with the monitoring interface to trigger a graph generation request. By crafting a malicious graph_title string, the attacker influences the command-line arguments generated by the LibreNMS backend. By injecting newline characters (e.g., %0a or \\n), the attacker can terminate the intended command prematurely and append new, arbitrary commands that the server executes with the privileges of the LibreNMS service user.\nThis mechanism allows for the retrieval of RRD data from devices that the attacker is not explicitly authorized to monitor or view. Because rrdtool is being invoked with these manipulated arguments, the application effectively acts as an agent for the attacker to read arbitrary files from the filesystem accessible to the LibreNMS process.\nThe impact is significant as it provides a vector for unauthorized information disclosure. By extracting data from unauthorized devices, an attacker can reconstruct network traffic patterns, device health metrics, or other sensitive infrastructure intelligence that would otherwise be protected by internal authorization checks. The ability to execute arbitrary rrdtool commands further extends the attack surface, potentially allowing the attacker to interact with the system in ways that were never intended by the software design.\nAffected systems include all deployments of LibreNMS prior to version 26.8.0. Mitigation necessitates the adoption of strict input validation and command-line argument construction practices, such as using array-based execution methods that bypass shell interpretation to ensure arguments are treated strictly as data rather than executable code."
}