What’s Vulnerable › Vulnerabilities

CVE-2026-27016: LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags()

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-20 · updated 2026-06-17
• Weakness: CWE-79

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.

Affected products

• librenms: from 24.10.0 before 26.2.0 — fixed in 26.2.0

How to fix

Upgrade to a fixed version: librenms 26.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/librenms/librenms/commit/3bea263e02441690c01dea7fa3fe6ffec94af335
• https://github.com/librenms/librenms/pull/19040
• https://github.com/librenms/librenms/releases/tag/26.2.0
• https://github.com/librenms/librenms/security/advisories/GHSA-fqx6-693c-f55g

Get alerted when CVE-2026-27016 or the next vulnerability affects your stack