CVE-2026-45694

Received Received - Intake

Reflected XSS in LibreNMS Proxmox Application View

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The parameters are placed into the page title with only strip_tags applied, and the title is then written into an inline document.title assignment through string interpolation, so a single quote terminates the JavaScript string and the remaining input runs as script. An attacker who lures an authenticated user into following a crafted link can execute script in that user's session, enabling actions such as theft of session data. This issue is fixed in version 26.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-45694

Affected Vendors & Products

Vendor	Product	Version / Range
librenms	librenms	to 26.4.0 (inc)
librenms	librenms	26.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in LibreNMS versions up to 26.4.0. It occurs in the Proxmox application view where user-supplied GET parameters 'instance' and 'vmid' are reflected into the page title without proper encoding. The parameters are inserted into the page title using only strip_tags, then written into a JavaScript document.title assignment. This allows an attacker to inject malicious script by terminating the JavaScript string with a single quote, enabling execution of arbitrary code in the user's session.

Detection Guidance

This vulnerability can be detected by checking the LibreNMS version. If your instance is running a version up to and including 26.4.0, it is vulnerable. No specific commands are provided for detection beyond version verification.

Impact Analysis

An attacker could trick an authenticated user into clicking a crafted link, allowing them to execute malicious scripts in the user's session. This could lead to theft of session data, unauthorized actions on behalf of the user, or further compromise of the system. The impact is limited to users who are already authenticated and follow malicious links.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected LibreNMS versions may face compliance risks if user sessions are compromised, potentially resulting in data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade LibreNMS to version 26.5.0 or later to address the vulnerability. This version includes the necessary fixes to prevent the reflected cross-site scripting issue.

Hi! I’m here to help you understand CVE-2026-45694. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70