CVE-2024-47526: LibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert_template.inc.php

Severity: low (CVSS 2.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-01 · updated 2026-06-17
Weakness: CWE-79

Description

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" feature allows users to inject arbitrary JavaScript into the alert template's name. This script executes immediately upon submission but does not persist after a page refresh.

Affected products

librenms: before 24.9.0 — fixed in 24.9.0

How to fix

Upgrade to a fixed version: librenms 24.9.0. Check the vendor advisory for mitigations.

References

https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40
https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205
https://github.com/librenms/librenms/commit/f259edc19b9f0ccca484c60b1ba70a0bfff97ef5
https://github.com/librenms/librenms/security/advisories/GHSA-gcgp-q2jq-fw52

Get alerted when CVE-2024-47526 or the next vulnerability affects your stack