The vulnerability is an authenticated Cross‑Site Scripting flaw in the showconfig page of LibreNMS. Only users with administrative privileges can inject malicious code; once the code runs it can affect any other user who subsequently visits the same page. The injected script can steal session cookies, modify page content, or perform other malicious actions within the victim’s browser. This is a typical instance of CWE‑79, where unsanitized user input is reflected in web content.

LibreNMS releases prior to version 26.3.0 are impacted when accessed via the web interface on the showconfig page. The flaw is limited to the LibreNMS product from the librenms vendor.

The CVSS score of 4.6 reflects a moderate impact, with no publicly reported exploitation probabilities or KEV listing. Exploitation requires valid administrative credentials, so the attack vector is an authenticated web interface. Because the vulnerability allows only client‑side code execution, it does not provide direct code execution on the server, but it can be used for user‑contamination or phishing attacks.