LibreNMS versions up to and including 26.2.0 contain a stored cross‑site scripting flaw in legacy PHP template pages that render unescaped SNMP‑sourced data fields such as BGP peer descriptions, VRF names, process information, and SLA tags. When an attacker with device management privileges or network access can enroll a rogue SNMP device, malicious JavaScript can be injected into these fields. The injected script runs in the context of an administrator’s session when the affected routing or device pages are viewed, enabling credential theft and exfiltration of CSRF tokens. This constitutes a direct threat to confidentiality and integrity of administrative accounts, as well as potential privilege escalation. Affected systems The vulnerability exists in LibreNMS releases up to 26.2.0. The impact is limited to installations that use the legacy PHP template rendering mechanism for SNMP‑derived data. Systems that have upgraded beyond 26.2.0, or that have disabled legacy templates, are not affected. Risk and exploitability The CVSS score of 5.8 indicates moderate severity. EPSS is not available. The issue is not listed in the CISA KEV catalog. The likely attack vector is network or device‑management access that allows an attacker to introduce a rogue SNMP device or modify existing SNMP data, after which the XSS payload is stored and executed in the web application context.

LibreNMS for versions up to 26.2.0

The CVSS score of 5.8 reflects a moderate severity, while the EPSS score is not reported. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by enrolling a rogue SNMP device or manipulating SNMP data on systems that use legacy PHP templates, leading to execution of malicious JavaScript in an administrator’s browser during routine page views.