{"id":"CVE-2026-55182","title":"LibreNMS is a network monitoring system","summary":"LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficient…","severity":"high","cwe":["CWE-77"],"vendor":"librenms","product":"librenms/librenms","affected":["librenms/librenms >= 21.6.0, < 26.5.0"],"patched":["librenms/librenms 26.5.0"],"published":"2026-08-26","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55182","references":[{"url":"https://github.com/librenms/librenms/commit/868e3b966a","label":"security-advisories@github.com"},{"url":"https://github.com/librenms/librenms/releases/tag/26.5.0","label":"security-advisories@github.com"},{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7","label":"security-advisories@github.com"},{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-c9fv-cgmm-2wg7"}],"tags":["nvd","ghsa","composer"],"epss":0.01128,"epssPercentile":0.64437,"aliases":["GHSA-c9fv-cgmm-2wg7"],"ecosystem":"composer","ingestedAt":"2026-08-18T18:21:29.808Z","slug":"CVE-2026-55182","body":"## Overview\n\nLibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55182)\n\nAffected packages:\n\n- `librenms/librenms >= 21.6.0, < 26.5.0`\n\nPatched in:\n\n- `librenms/librenms 26.5.0`\n\nSource: https://github.com/advisories/GHSA-c9fv-cgmm-2wg7","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}