LibreNMS CVE-2026-55182

Exploitation requires an authenticated session with LibreNMS administrator privileges - standard (non-admin) user accounts cannot access the Alert Transports configuration page. The attacker must be able to create or modify Alert Transport entries and trigger the 'Test Transport' action. The Signal transport type must be present in the transport list, which it is in default installations. No special server-side configuration of the Signal messaging service is required - the exploit abuses the path and recipient fields without needing a functional Signal setup. The principal limiting factor is the PR:H (high-privilege) requirement per the CVSS 4.0 vector: an unauthenticated or low-privileged attacker has no direct path to exploitation and must first acquire admin credentials.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 8.6) accurately reflects a network-reachable attack with no complexity barrier and no user interaction - but the PR:H metric is the pivotal constraint: exploitation is gated entirely on possession of a valid LibreNMS administrator account. This substantially narrows the realistic attacker population to insiders, compromised privileged accounts, or attackers who have already achieved credential theft. The absence of a CISA KEV listing indicates no confirmed widespread exploitation at time of analysis; however, the fully detailed public PoC in the advisory lowers the skill bar to near zero for anyone who does hold admin access. EPSS data was not provided, but given the high privilege requirement, mass automated exploitation is unlikely. The primary risk scenario is post-compromise privilege escalation or insider abuse: the jump from LibreNMS admin to full OS command execution is trivial and one-click once credentials are in hand, meaning any environment with shared or weakly protected admin credentials should treat this as urgent. My independent CVSS 3.1 assessment yields S:C (scope change) because exec() breaks out of the web application boundary to the underlying OS, which the vendor's 4.0 SC:N metrics arguably understate.

A publicly available proof-of-concept documents the full chain: an authenticated administrator navigates to Dashboard → Alert → Alert Transports, creates a new Signal transport entry setting the Path to ../scripts/composer_wrapper.php and the Recipient field to ;id; (or any shell command), saves the entry, and clicks the 'Test Transport' button - causing the web server process to execute the injected OS command and return output. The attacker can substitute any accessible binary or shell payload, enabling privilege escalation, reverse shell establishment, credential harvesting, or lateral movement.