GHSA-7cj5-v4pp-v632: XSS

Q: Who can exploit this issue, and who is exposed to the payload?

Any administrator who can modify a graph_descr.<graphtype> setting can store the payload. It executes when authenticated users view the affected graph type, so the exposure is to authenticated graph viewers rather than unauthenticated visitors.

Published Aug 18, 2026

Updated

Summary The graphdescr.<graphtype> family of settings is echoed verbatim without htmlspecialchars() in includes/html/pages/graphs.inc.php:194. Any admin can store a malicious HTML payload that executes in every authenticated user's browser viewing that graph type.

CVSS CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N — 4.8 Medium

Details php // graphs.inc.php:194 echo LibrenmsConfig::get('graphdescr.' . $vars['type']);

PoC PUT /settings/graphdescr.deviceprocessor {"value": "<img src=x onerror=\"alert('ADV-15')\">"}

GET /graphs?type=deviceprocessor → <img src=x onerror="alert('ADV-15')">

Fix php echo htmlspecialchars(LibrenmsConfig::get('graphdescr.' . $vars['type']), ENTQUOTES, 'UTF-8');

Prerequisite Admin session to set the config value.

Affected Software

1 affected componentFixes available

composer/librenms/librenms<26.7.0

26.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/librenms/librenms to a version that resolves this vulnerability.
Fixed in 26.7.0

Event History

Aug 18, 2026

Advisory Published

via GitHub·09:17 PM

Data Sourced

via GitHub·09:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

Any administrator who can modify a graph_descr.<graphtype> setting can store the payload. It executes when authenticated users view the affected graph type, so the exposure is to authenticated graph viewers rather than unauthenticated visitors.

What conditions are required for exploitation?

Exploitation requires an admin session to set a malicious graph description value and a user interaction: an authenticated user must open a graph page for that graph type. The provided example uses graph_descr.device_processor and the /graphs?type=device_processor page.

What can be done while a patch is unavailable?

If patching is not immediately possible, restrict access to administrators who can change graph description settings and review graph_descr.<graphtype> values for HTML or script-like payloads. Remove any untrusted values, particularly descriptions containing event-handler attributes such as onerror.

How can I determine whether my instance has been affected?

Inspect configured graph_descr.<graphtype> values and load the corresponding graph pages while authenticated. Affected instances render the configured description verbatim; the issue is present where the value is output without HTML escaping.