LibreNMS CVE-2026-109354

Exploitation requires the attacker to be an authenticated LibreNMS user (PR:L) who already has authorized access to at least one NFSen-enabled device, and the target deployment must have the NFSen/NetFlow integration enabled so that nfsen_channel_common.inc.php and the graph.php channel parameter are reachable. The attack is network-remote with low complexity and no user interaction, but it is bounded by these prerequisites: it yields only read access to RRD graph data (traffic/NetFlow) of other devices, grants no write/integrity or availability impact, and is irrelevant to single-tenant installs where the authenticated user is already entitled to all devices. Installations without NFSen enabled are not exposed through this code path.

This is a moderate-severity information-disclosure flaw, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with a 5.3 score indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, but impact is limited to confidentiality (VC:L) with no integrity or availability effect - the attacker reads RRD traffic/NetFlow graph data outside their authorized scope, a horizontal authorization bypass rather than code execution or full data exfiltration. The PR:L requirement is the key risk limiter: the attacker must already be an authenticated LibreNMS user with access to at least one NFSen-enabled device, so this is a privilege-boundary/multi-tenancy issue rather than an unauthenticated breach. No CISA KEV listing and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS was not supplied. Note the input provides only a CVSS 4.0 vector and no SSVC decision data - exploitation-status, automatable, and technical-impact SSVC fields are absent and cannot be cross-referenced. Overall: real but low-urgency, most relevant to shared/multi-user LibreNMS deployments where tenant isolation matters.

An authenticated LibreNMS user who is authorized to view only one NFSen-enabled device crafts a request to graph.php, injecting '../' sequences into the channel parameter handled by nfsen_channel_common.inc.php. The traversed path causes the application to read RRD files belonging to devices outside the user's authorized scope, letting them view traffic and NetFlow graphs for unauthorized hosts. No public proof-of-concept was provided in the source data.