What’s Vulnerable › Vulnerabilities

CVE-2025-55296: LibreNMS allows stored XSS in Alert Template name field

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 17.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-18 · updated 2026-06-17
• Weakness: CWE-79

Description

librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template is rendered, potentially compromising other admin accounts. This vulnerability is fixed in 25.8.0.

Affected products

• librenms: before 25.8.0 — fixed in 25.8.0

How to fix

Upgrade to a fixed version: librenms 25.8.0. Check the vendor advisory for mitigations.

References

• https://github.com/librenms/librenms/commit/8ade3d827d317f5ac4b336617aafff865f825958
• https://github.com/librenms/librenms/security/advisories/GHSA-vxq6-8cwm-wj99

Get alerted when CVE-2025-55296 or the next vulnerability affects your stack