LibreNMS CVE-2025-62365

The report_this() function writes Config::get('project_issues') into an href attribute filtered only by htmlentities(), which encodes HTML entities but does NOT neutralize dangerous URL schemes such as javascript: or file:. Exploitation requires (1) the project_issues value to be attacker-influenced (per the GHSA PoC, project_issues=javascript:alert(document.cookie)) and (2) reaching one of the error paths that invoke report_this() - the device alerts, device logs, routing, search, or tools pages when given an unknown section/protocol/type. Limiting factors: a victim must visit the crafted page and activate the injected 'report this' link (user interaction required, contradicting the vendor vector's UI:N); impact is confined to the victim's browser session (session theft) with no server-side compromise; and the issue is fully remediated in version 25.7.0.

This is a moderate-severity reflected XSS (CVSS 4.0 base 5.5, CWE-79) that is a low-urgency patching item rather than an emergency. Signals are consistent and mostly point to low real-world risk: EPSS is 0.25% (15th percentile), the vulnerability is NOT on CISA KEV, and exploitation status is publicly available exploit code exists (the GHSA includes a working PoC) - but POC availability is distinct from active exploitation and there is no evidence of in-the-wild use. One notable conflict: the vendor-supplied CVSS 4.0 vector lists UI:N (no user interaction), which contradicts the reflected-XSS nature of the flaw - reflected XSS inherently requires a victim to visit or click an attacker-crafted request, so UI should realistically be Active; defenders should treat this as requiring victim interaction despite the vector. The vector also correctly models impact as confined to a subsequent system (SC:L/SI:L with VC/VI/VA:N), i.e. the victim's browser, not the LibreNMS server itself. Net: a real but bounded issue worth patching to 25.7.0 on a normal cycle, not a drop-everything priority.

An attacker crafts a LibreNMS URL that forces the application into an error path which calls report_this() and injects a javascript: payload into the project_issues value (PoC: project_issues=javascript:alert(document.cookie)), which is written unescaped into an href attribute. The attacker sends this link to a LibreNMS operator; when the authenticated victim opens it and activates the malicious 'report this' link, the script runs in their browser and can exfiltrate session cookies. A public PoC exists in the GHSA advisory, lowering the barrier to weaponization.