What is the CVSS score of EUVD-2026-22251?

EUVD-2026-22251 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

LibreNMS EUVD-2026-22251

| CVE-2026-30480 MEDIUM

PHP Remote File Inclusion (CWE-98)

2026-04-14 mitre

PHP Path Traversal LFI N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable via HTTP, low-privilege auth required per description; file inclusion reads data only, so integrity and availability impacts are correctly set to None.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:43 vuln.today

CVSS changed

Apr 16, 2026 - 13:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22251

CVE Published

Apr 14, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attackers to include arbitrary PHP files from the server filesystem via path traversal sequences in the nfsen parameter.

AnalysisAI

Local File Inclusion in LibreNMS's NFSen module (nfsen.inc.php) enables authenticated low-privilege users to traverse the server filesystem and include arbitrary PHP files by manipulating the nfsen HTTP parameter with path traversal sequences. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.02% (5th percentile) and SSVC non-automatable classification indicate limited mass-exploitation potential. The vulnerability carries high confidentiality impact per CVSS - sensitive configuration files, credentials, or other PHP-readable data on the server are at risk - while integrity and availability remain unaffected.

Technical ContextAI

LibreNMS is an open-source PHP-based network monitoring platform that integrates with NfSen (NetFlow Sensor) for flow data analysis via the nfsen.inc.php module. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP), a PHP-specific variant of path traversal where unsanitized user-controlled input is passed directly to a PHP include/require construct. By injecting traversal sequences such as '../../../' into the nfsen parameter, an attacker can escape the intended include directory and load arbitrary PHP files from the server filesystem. The affected version is 22.11.0-23-gd091788f2; the CPE entry (cpe:2.3:a:n/a:n/a) is not yet formally registered in the NVD dictionary, so exact version boundaries are inferred from the description. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms network-accessible exploitation requiring only low-privilege authentication with no user interaction.

RemediationAI

No vendor-released patch version has been independently confirmed from the available data; operators should monitor the LibreNMS GitHub repository and official release notes for a fix addressing path traversal sanitization in nfsen.inc.php. As an immediate compensating control, disable the NfSen module entirely if NetFlow Sensor integration is not operationally required - this eliminates the vulnerable code path with no impact on core LibreNMS network monitoring functionality. If NfSen must remain enabled, restrict LibreNMS web interface access to trusted internal networks or VPN endpoints to reduce the pool of potential authenticated attackers; note this does not prevent exploitation by insider or compromised accounts. Deploy WAF rules blocking path traversal patterns (e.g., ../, ..%2F, ..%5C) in HTTP parameters as a defense-in-depth layer, acknowledging that encoding bypasses may reduce this control's effectiveness. Audit and minimize the number of LibreNMS user accounts with web interface access, revoking any unnecessary low-privilege accounts. Reference the public PoC at https://github.com/parlakbarann/CVE-2026-30480 to test whether deployed WAF or firewall controls successfully block the demonstrated attack patterns.