CyberRota Analysis
AI-GeneratedLibreNMS versions up to 26.4.0 are vulnerable to a stored cross-site scripting (XSS) flaw in the graph configuration settings, allowing an attacker to inject malicious HTML that executes in the browsers of authenticated users viewing the affected graphs. This vulnerability poses a risk of unauthorized actions or data exposure for users interacting with the compromised graphs. Administrators using affected versions should prioritize upgrading to version 26.7.0 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in version 26.7.0.