The vulnerability resides in the nfsen_channel_common.inc.php file of LibreNMS, where an authenticated user can inject path traversal sequences into the channel parameter in graph.php. This allows the user to read RRD files from locations outside the intended scope, exposing traffic and NetFlow charts of devices they should not have access to. The weakness is a classic path traversal flaw (CWE-22) that enables unauthorized file access, potentially revealing confidential network topology and usage data.

LibreNMS installations before version 26.9.0 are affected. The issue has been documented for the LibreNMS product offered under the librenms:librenms identifier. The affected component is the NFSen integration and the vulnerable file is nfsen_channel_common.inc.php. Users running earlier releases should verify the version and apply mitigations.

The CVSS score of 5.3 indicates moderate severity. Exploit probability is unknown due to missing EPSS data, and the vulnerability is not listed in the CISA KEV catalog. Attacks would exploit the path traversal via the channel parameter, requiring only authenticated access to an NFSen-enabled device and the ability to request graph.php. While the flaw does not provide code execution, it grants the attacker the ability to read protected RRD data, making it a moderate risk for confidentiality and scope expansion.