CVE-2025-62365: LibreNMS vulnerable to Reflected-XSS in `report_this` function
Summary Reflected-XSS in reportthis function in librenms/includes/functions.php
Details Recently, it was discovered that the reportthis function had improper filtering (htmlentities function was incorrectly used in a href environment), which caused the projectissues parameter to trigger an XSS vulnerability.
The Vulnerable Sink: https://github.com/librenms/librenms/blob/master/includes/functions.php#L444
PoC GET projectissues=javascript:alert(document.cookie)
Impact XSS vulnerabilities allow attackers to execute malicious scripts in users' browsers, enabling unauthorized access to sensitive data, session hijacking, or malware distribution.
Suggestion It is recommended to filter dangerous protocols, e.g. javascript:/file:.
Other sources
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in reportthis function in librenms/includes/functions.php. The reportthis function had improper filtering (htmlentities function was incorrectly use in a href environment), which caused the projectissues parameter to trigger an XSS vulnerability. This vulnerability is fixed in 25.7.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62365?
CVE-2025-62365 has a moderate severity due to its reflected XSS vulnerability.
How do I fix CVE-2025-62365?
To fix CVE-2025-62365, upgrade your LibreNMS installation to version 25.7.0 or later.
Which versions of LibreNMS are affected by CVE-2025-62365?
CVE-2025-62365 affects all LibreNMS versions prior to 25.7.0.
What type of vulnerability is CVE-2025-62365?
CVE-2025-62365 is a reflected cross-site scripting (XSS) vulnerability.
What feature of LibreNMS is vulnerable in CVE-2025-62365?
The vulnerability in CVE-2025-62365 exists in the 'report_this' function in librenms/includes/functions.php.