---
id: CVE-2026-55182
title: LibreNMS is a network monitoring system
summary: >-
  LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0,
  the Signal alert transport is vulnerable to command injection because the
  signal-cli path and the Recipient field of an alert transport entry are
  insufficient…
severity: high
cwe:
  - CWE-77
vendor: librenms
product: librenms/librenms
affected:
  - 'librenms/librenms >= 21.6.0, < 26.5.0'
patched:
  - librenms/librenms 26.5.0
published: '2026-08-26'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55182'
references:
  - url: 'https://github.com/librenms/librenms/commit/868e3b966a'
    label: security-advisories@github.com
  - url: 'https://github.com/librenms/librenms/releases/tag/26.5.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7
    label: security-advisories@github.com
  - url: >-
      https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-c9fv-cgmm-2wg7'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.01128
epssPercentile: 0.64959
aliases:
  - GHSA-c9fv-cgmm-2wg7
ecosystem: composer
ingestedAt: '2026-08-18T18:21:29.808Z'
---

## Overview

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55182)

Affected packages:

- `librenms/librenms >= 21.6.0, < 26.5.0`

Patched in:

- `librenms/librenms 26.5.0`

Source: https://github.com/advisories/GHSA-c9fv-cgmm-2wg7