QwikSec

Security Database

CVE

CWE

Training

CVE-2026-27016

Published: Feb 20, 2026

Modified: Feb 20, 2026

PUBLISHED

CVSS v3.1

5.4

MEDIUM

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.

Vendor	Product	Versions
librenms	librenms	affected `>= 24.10.0, < 26.2.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

https://github.com/librenms/librenms/security/advisories/GHSA-fqx6-693c-f55g

x_refsource_CONFIRM

https://github.com/librenms/librenms/pull/19040

x_refsource_MISC

https://github.com/librenms/librenms/commit/3bea263e02441690c01dea7fa3fe6ffec94af335

x_refsource_MISC

https://github.com/librenms/librenms/releases/tag/26.2.0

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.