LibreNMS Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting (XSS) vulnerability has been identified in LibreNMS versions through 25.12.0. The issue arises in the email input field, where malicious scripts can be injected and executed. This vulnerability has been addressed in version 26.2.0.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the email settings page. In the email address input field, enter a payload that includes a script, such as an image tag with an 'onerror' event. This will trigger an alert displaying the document's cookies, demonstrating the successful execution of the injected script.

Remediation

Users can upgrade to LibreNMS version 26.2.0 or later to address this vulnerability.