CVE-2026-55182High▾ TwilightLibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficient…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.1%
Last analysed / modified upstream
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
librenms/librenms >= 21.6.0, < 26.5.0Patched in:
librenms/librenms 26.5.0Connected by shared product, vendor, weakness, or advisory.
GHSA-jf24-8g2h-2wg7MediumLibreNMS Vulnerable to Remote Code Execution via AboutController
GHSA-7w8c-qgxg-m7jxHigh· 7.1LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
CVE-2026-45694Medium· 5.4LibreNMS is a network monitoring system
GHSA-7cj5-v4pp-v632Medium· 4.8LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users
GHSA-7gww-x7fh-jf9jHigh· 8.1LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
CVE-2026-86427High· 8.8LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping