Stored Cross-Site Scripting in LibreNMS Affected by Unescaped SNMP and Syslog Data

CVE-2026-84192

What is CVE-2026-84192?

LibreNMS versions earlier than 26.3.1 are susceptible to a stored cross-site scripting vulnerability found within legacy PHP templates. The flaw arises from the improper handling of data sourced from SNMP interfaces and syslog program fields, which are presented to users without necessary escaping. This allows an attacker controlling a network device to inject harmful JavaScript, which can be executed when authenticated users access affected web pages. It's crucial for users of LibreNMS to update to the latest version to mitigate the risk associated with this vulnerability.

References