CVE-2026-84188: librenms before 26.7.0 Stored XSS via graph_descr settings
LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graphdescr.<graphtype> configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in version 26.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreNMSto a version that resolves this vulnerability.Fixed in 26.7.0
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the payload?
An administrator must be able to modify graph_descr.<graphtype> configuration settings to store the malicious HTML. Any authenticated user who views the corresponding affected graph type can have the payload execute in their browser.
Are default LibreNMS installations affected?
The issue affects LibreNMS versions through 26.4.0 when a malicious value has been stored in a graph_descr.<graphtype> setting. Exploitation requires an administrator to configure such a payload; the provided data does not indicate that default settings contain one.
How can I determine whether an instance may already be affected?
Check whether the LibreNMS version is 26.4.0 or earlier, then review graph_descr.<graphtype> configuration values for HTML or unexpected content. Also identify whether authenticated users have viewed graph pages associated with any suspicious configured graph descriptions.
What should be done if an upgrade cannot happen immediately?
Restrict access to graph_descr.<graphtype> configuration settings to trusted administrators and inspect existing values for malicious HTML. Remove or replace suspicious graph description values to prevent them from being echoed to authenticated graph viewers.