Description
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.
Published: 2026-08-26
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

LibreNMS versions 21.6.0 through 26.4.x allow an authenticated administrator to craft a signal alert transport entry that includes shell metacharacters in the Recipient field and a path to the bundled composer_wrapper.php script. The application then passes these unsanitized inputs to exec calls, enabling command injection and arbitrary operating‑system command execution. This flaw is a command injection vulnerability (CWE‑77) that grants full control over the server hosting LibreNMS.

Affected Systems

The vulnerable product is LibreNMS, a network monitoring system. All releases from 21.6.0 through 26.4.x (inclusive) are affected; the issue is resolved in version 26.5.0 and later. Any deployment that uses the signal alert transport module in these legacy releases is at risk.

Risk and Exploitability

The CVSS score of 8.6 indicates a high‑severity flaw. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate with administrator privileges to create or modify a signal alert transport entry. Based on the description, it is inferred that the creation of such an entry can be performed remotely through the web interface, making the exploitation path likely remote once credentials are obtained. The impact is total system compromise, and the risk remains significant for environments running affected releases with the signal transport enabled.

Generated by OpenCVE AI on August 26, 2026 at 23:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade LibreNMS to version 26.5.0 or later, which eliminates the vulnerable transport logic.
  • Limit the creation and modification of signal alert transport entries to a minimal set of trusted administrators, enforcing the principle of least privilege.
  • If the signal transport module is not required, remove or disable it; otherwise, apply input validation that escapes shell metacharacters in the Recipient field and prevent passing unsanitized data to exec calls.

Generated by OpenCVE AI on August 26, 2026 at 23:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-c9fv-cgmm-2wg7 LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
History

Wed, 26 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Librenms
Librenms librenms
Vendors & Products Librenms
Librenms librenms

Wed, 26 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.
Title LibreNMS: Remote Code Execution by Signal Alert Transportation Module
Weaknesses CWE-77
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Librenms Librenms
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-26T21:50:04.014Z

Reserved: 2026-06-16T15:20:43.086Z

Link: CVE-2026-55182

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T22:16:24.950

Modified: 2026-08-26T22:16:24.950

Link: CVE-2026-55182

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T23:45:03Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')