CVE-2026-109354: LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter
LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traversed channel value to view traffic and NetFlow graphs of devices outside their authorized scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreNMSto a version that resolves this vulnerability.Fixed in 26.9.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated LibreNMS user who has access to at least one NFSen-enabled device can exploit it. The attacker uses the graph.php endpoint and controls the channel parameter.
What information can an attacker access?
The issue allows reading unauthorized RRD data, including traffic and NetFlow graphs for devices outside the user's authorized scope. The provided information does not indicate that it allows modification or deletion of data.
Which deployments are affected?
LibreNMS versions before 26.9.0 are affected where NFSen-enabled devices are in use. Exploitation depends on an attacker having an authenticated account with access to one such device.
How can teams identify possible exploitation?
Review requests to graph.php from authenticated users for channel parameter values containing ../ sequences. Such values may indicate an attempt to traverse to RRD data associated with devices beyond the user's permitted scope.