What is the CVSS score of CVE-2026-45694?

CVE-2026-45694 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-45694?

Yes, a public proof-of-concept exploit is available for CVE-2026-45694. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-45694?

Yes, a patch is available for CVE-2026-45694. Update the affected software to the latest version immediately.

LibreNMS CVE-2026-45694

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-12 https://github.com/librenms/librenms

GHSA-jmqm-f8q4-v7wx

PHP XSS

5.4

CVSS 3.1 · Vendor: https://github.com/librenms/librenms

Severity by source

Vendor (https://github.com/librenms/librenms) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible endpoint (AV:N), attacker requires a valid account (PR:L), victim must click crafted link (UI:R), browser context escape constitutes scope change (S:C), no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (https://github.com/librenms/librenms).

CVSS VectorVendor: https://github.com/librenms/librenms

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 12, 2026 - 16:10 vuln.today

Analysis Generated

Aug 12, 2026 - 16:10 vuln.today

DescriptionCVE.org

Summary

LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars['instance'] and $vars['vmid'] (GET params, only strip_tags() applied) directly into $pagetitle. A single quote terminates the JS string, executing arbitrary script.

Details

php

// LegacyController.php:75
$html .= "<script>\ndocument.title = '$title';\n</script>";

// proxmox.inc.php:38,42
$pagetitle[] = $instance;     // GET ?instance=
$pagetitle[] = $vars['vmid']; // GET ?vmid=

PoC

http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//

Confirmed in response:
document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';

Fix

php

// LegacyController.php:75
$html .= "<script>\ndocument.title = " . json_encode($title) . ";\n</script>";

Also wrap $instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php.

Prerequisite

Any authenticated session. Victim must follow a crafted link.

AnalysisAI

Reflected XSS in LibreNMS 26.4.0 and earlier allows an authenticated attacker to inject arbitrary JavaScript into any victim's browser session by embedding a payload in the GET parameters instance or vmid of the Proxmox application module. The root cause is unsafe PHP string interpolation of unsanitized GET input directly into a document.title JavaScript assignment in LegacyController.php:75, bypassed with a simple single-quote injection. A working proof-of-concept demonstrating cookie exfiltration is publicly documented in the GitHub security advisory GHSA-jmqm-f8q4-v7wx; this CVE is not in CISA KEV.

Technical ContextAI

LibreNMS is a PHP-based open-source network monitoring system (composer package librenms/librenms, CPE: pkg:composer/librenms_librenms). The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS). In LegacyController.php at line 75, the shared page-title rendering path outputs: $html .= "<script>\ndocument.title = '$title';\n</script>"; - placing the title value inside a single-quoted JavaScript string with no JS-context escaping. The Proxmox application integration in apps/proxmox.inc.php (lines 38 and 42) populates $pagetitle with the raw values of the GET parameters ?instance= and ?vmid=, applying only strip_tags() - which strips HTML tags but preserves single quotes, semicolons, and all other JavaScript metacharacters. Because these values flow into $title and then into the JavaScript string context, a single quote in the input terminates the JS string literal and allows arbitrary script injection. The correct fix is to use json_encode() for the JavaScript context (ensuring proper escaping of all string metacharacters) and htmlspecialchars() for HTML attribute contexts in proxmox.inc.php.

RemediationAI

Upgrade to LibreNMS 26.5.0, released 2026-05-18, which resolves the issue by replacing the unsafe string interpolation in LegacyController.php:75 with json_encode($title) for proper JavaScript-context escaping, and by adding htmlspecialchars() around $instance and $vars['vmid'] in proxmox.inc.php. The release is available at https://github.com/librenms/librenms/releases/tag/26.5.0. If immediate upgrade is not feasible, block access to the Proxmox application endpoint (/apps?app=proxmox) at the web server or reverse-proxy layer via ACL rule; this eliminates the attack surface for this specific module at the cost of disabling Proxmox monitoring capability until the patch is applied. Additionally, restricting LibreNMS web access to a trusted internal network or VPN reduces the social engineering vector by limiting who can deliver crafted URLs to authenticated users.