Local File Inclusion Vulnerability in LibreNMS NFSen Module
CVE-2026-30480

6.5MEDIUM

Key Information:

Vendor

LibreNMS

Status
NFSen Module
Vendor
CVE Published:
14 April 2026

What is CVE-2026-30480?

A Local File Inclusion (LFI) vulnerability exists in the NFSen module of LibreNMS, specifically in the nfsen.inc.php file. Authenticated attackers can exploit this flaw to include arbitrary PHP files from the server’s filesystem by using path traversal sequences in the nfsen parameter. This vulnerability poses a significant risk as it allows potential unauthorized access to sensitive information and system files, compromising the integrity and confidentiality of the system.

References

https://github.com/parlakbarann/CVE-2026-30480

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.