CVE-2026-45694: XSS
Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars['instance'] and $vars['vmid'] (GET params, only striptags() applied) directly into $pagetitle. A single quote terminates the JS string, executing arbitrary script.
Details php // LegacyController.php:75 $html .= "<script>\ndocument.title = '$title';\n</script>";
// proxmox.inc.php:38,42 $pagetitle[] = $instance; // GET ?instance= $pagetitle[] = $vars['vmid']; // GET ?vmid=
PoC http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//
Confirmed in response: document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';
Fix php // LegacyController.php:75 $html .= "<script>\ndocument.title = " . jsonencode($title) . ";\n</script>"; Also wrap $instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php.
Prerequisite Any authenticated session. Victim must follow a crafted link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/librenms/librenmsto a version that resolves this vulnerability.Fixed in 26.5.0 - Configuration
In proxmox.inc.php, apply htmlspecialchars() to both $vars['instance'] and $vars['vmid'] before pushing them into $pagetitle (currently they are derived from GET parameters and only strip_tags() is applied). This prevents breaking out of the JavaScript single-quoted string that becomes document.title.
apps/proxmox.inc.php Sanitize page title variables used in JavaScript string assignment = Wrap $vars['instance'] and $vars['vmid'] in htmlspecialchars() (in addition to the existing strip_tags())
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45694?
CVE-2026-45694 has a medium severity score of 5.4.
How do I fix CVE-2026-45694?
To mitigate CVE-2026-45694, ensure proper escaping or validation of user input before using it in JavaScript assignments.
What types of attacks are possible with CVE-2026-45694?
CVE-2026-45694 enables cross-site scripting (XSS) attacks due to improper handling of user input in JavaScript.
Which versions of the software are affected by CVE-2026-45694?
CVE-2026-45694 affects certain versions of the composer/librenms/librenms software prior to the fixes implemented in version 26.5.0.
What is the impact of CVE-2026-45694?
The impact of CVE-2026-45694 includes potential unauthorized execution of scripts in the user's browser, leading to data theft or session hijacking.