Description
LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in version 26.7.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| librenms | librenms | < 26.7.0 | 26.7.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | librenms/librenms | < 26.7.0 | 26.7.0 | GHSA-7cj5-v4pp-v632 |
References
- GitHub Security Advisory (GHSA-7cj5-v4pp-v632) vendor-advisory
- VulnCheck Advisory: librenms before 26.7.0 Stored XSS via graph_descr settings third-party-advisory