Stored Cross-Site Scripting Vulnerability in LibreNMS Network Monitoring System
CVE-2025-55296

5.5MEDIUM

Key Information:

Vendor

Librenms

Status
Librenms
Vendor
CVE Published:
18 August 2025

What is CVE-2025-55296?

In the LibreNMS network monitoring system, a stored Cross-Site Scripting (XSS) vulnerability is present in the Alert Template creation feature. This flaw allows unauthorized users, particularly those with admin privileges, to inject malicious JavaScript code. When the template is rendered, this injected code executes, potentially leading to the compromise of other admin accounts within the system. This vulnerability has been addressed in the latest release, version 25.8.0, highlighting the importance of updating to this version to protect against exploitation.

Affected Version(s)

librenms < 25.8.0

References

https://github.com/librenms/librenms/security/advisories/...
x_refsource_CONFIRM
https://github.com/librenms/librenms/commit/8ade3d827d317...
x_refsource_MISC

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.