CVE-2025-23201: Reflected Cross-site Scripting on error alert in librenms
librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:/addhost -> param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Other sources
XSS on the parameters:/addhost -> param: community
of Librenms versions 24.10.1 (https://github.com/librenms/librenms) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.
Proof of Concept: 1. Navigate to the /addhost path. 2. Fill in all required fields. 3. In the Community field, enter the following payload: "><img src=a onerror="alert(1)">. !image
4. Submit the form to save changes. 5 The script will execute when the error alert "No reply with community + payload" appears. !image
Impact:
Execution of Malicious Code
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23201?
CVE-2025-23201 has a medium severity rating due to the potential for Cross-site Scripting (XSS) attacks.
How do I fix CVE-2025-23201?
To mitigate CVE-2025-23201, upgrade to Librenms version 24.11.0 or later.
What versions are affected by CVE-2025-23201?
Librenms versions up to and including 24.10.1 are affected by CVE-2025-23201.
What kind of attack can CVE-2025-23201 facilitate?
CVE-2025-23201 can facilitate Cross-site Scripting (XSS) attacks through the `/addhost` parameter.
Who is impacted by CVE-2025-23201?
Remote attackers can exploit CVE-2025-23201 to inject malicious scripts affecting users of vulnerable Librenms versions.