Remote File Inclusion Vulnerability in LibreNMS Network Monitoring Tool

CVE-2025-54138

What is CVE-2025-54138?

LibreNMS, an auto-discovering PHP/MySQL/SNMP-based network monitoring tool, contains an architectural flaw in the ajax_form.php endpoint. This vulnerability allows for Remote File Inclusion via unvalidated user POST input, specifically through the type parameter. Because this parameter is used directly to include .inc.php files from a designated trusted path, an attacker may exploit this weakness to perform Remote Code Execution if they can manipulate files in the inclusion path. This risk emerges from potential misconfigurations or through symlink exploitation. The issue has been addressed in version 25.7.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References