CVE-2026-27016

Katalog CVE

CVSS 5.4 · Medium EPSS 0,32%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada librenms. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.

Rincian

Terbit di NVD

20 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/librenms/librenms/commit/3bea263e02441690c01dea7fa3fe6ffec94af335 patch
• https://github.com/librenms/librenms/security/advisories/GHSA-fqx6-693c-f55g advisory pihak ketiga
• https://github.com/librenms/librenms/pull/19040 issue tracking
• https://github.com/librenms/librenms/releases/tag/26.2.0 product · release notes