EUVD-2026-69026
GHSA-r436-6p4j-frwf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-only oxidized.url setting forces PR:H; a victim must view showconfig so UI:R; injected script executing in other users' sessions is a scope change (S:C) with C:H/I:H, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0.
AnalysisAI
Stored cross-site scripting in LibreNMS through 26.4.0 lets an administrator (or an attacker who has hijacked an admin session) chain an SSRF into persistent XSS by pointing the admin-configurable Oxidized integration URL (oxidized.url) at an attacker-controlled server. That server returns malicious JSON whose name, ip, model, author, and commit-message fields are rendered into the device showconfig page without htmlspecialchars(), so any user viewing any device's showconfig tab executes attacker-supplied JavaScript. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated LibreNMS administrator session, because oxidized.url is an admin-only configuration setting (PR:H); (2) the Oxidized integration must be enabled and its URL pointed at an attacker-controlled or attacker-influenceable server (the SSRF pivot); and (3) victim user interaction - a user must open a device's showconfig tab for the stored payload to execute (UI:P/R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are moderately consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 26.7.0 - upgrade LibreNMS to 26.7.0 or later, which adds htmlspecialchars($value, ENT_QUOTES, 'UTF-8') encoding to all fields sourced from $node_info, $author, and $msg on the showconfig page (per GHSA-7gww-x7fh-jf9j). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately audit whether the Oxidized integration is enabled and in use; if enabled, disable it until patched, and review admin access logs for unauthorized configuration changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 7.2), this vulnerability is remotely exploit
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. Rate
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database informatio
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated high severity (CVSS 8.8), this vulnera
An issue was discovered in LibreNMS before 1.65.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
An issue was discovered in LibreNMS 1.50.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit
Command injection in LibreNMS's Virtualization Discovery module enables authenticated administrator-level users to execu
Remote code execution in LibreNMS network monitoring platform (versions prior to 26.3.0) allows authenticated administra
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today