Stored XSS Vulnerability in LibreNMS Network Monitoring Tool

CVE-2026-27016

What is CVE-2026-27016?

LibreNMS, a network monitoring tool, has a vulnerability that allows for stored Cross-Site Scripting (XSS) through the Custom OID feature. Specifically, the issue arises from the lack of sanitization for the 'unit' parameter, which does not employ 'strip_tags()' to secure input. While other parameters like name, oid, and datatype are properly sanitized, the unsanitized value is stored in the database and can lead to potential XSS attacks when rendered without HTML escaping. This vulnerability has been addressed in version 26.2.0.

References