LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users

Mô tả

// graphs.inc.php:194
echo LibrenmsConfig::get('graph_descr.' . $vars['type']);

PUT /settings/graph_descr.device_processor
{"value": "<img src=x onerror=\"alert('ADV-15')\">"}

GET /graphs?type=device_processor
→ <img src=x onerror="alert('ADV-15')">

echo htmlspecialchars(LibrenmsConfig::get('graph_descr.' . $vars['type']), ENT_QUOTES, 'UTF-8');

Tham khảo

• librenms/librenms security advisory · WEB
• librenms/librenms · PACKAGE
• librenms/librenms release 26.7.0 · WEB
• vulncheck.com/advisories/librenms-before-26.7.0-stored-xss-via-graph-descr-settings

Lỗ hổng khác của librenms/librenms

• CVE-2026-84192CAO 7.1LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sour…
• CVE-2026-84190CAO 7.2LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration paramet…
• CVE-2026-84189CAO 8.1LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integratio…
• CVE-2026-55182CAO 8.6LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection…
• CVE-2026-45694TRUNG BÌNH 5.4LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cro…