{"id":"CVE-2026-2728","aliases":["EUVD-2026-21907","GHSA-5gm9-622f-qcg5","GHSA-rp7w-624x-95qv"],"status":"published","title":"LibreNMS: Cross-Site Scripting in ShowConfigController","description":"LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.","severity":{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00229,"percentile":0.1386,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-04-13T10:39:54Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"Packagist","package":"librenms/librenms","fixed_in":["26.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"librenms/librenms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.12.0"},{"fixed":"26.3.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"librenms/librenms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.12.0"},{"fixed":"26.3.0"}]}],"versions":["25.12.0","26.1.0","26.1.1","26.2.0"]}],"products":[{"vendor":"librenms","product":"librenms"}],"references":[{"url":"https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#xss-on-showconfig-page-2630","tags":["exploit","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-5gm9-622f-qcg5","tags":["web"]},{"url":"https://github.com/librenms/librenms/releases/tag/26.3.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5gm9-622f-qcg5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2728","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rp7w-624x-95qv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2728.json","tags":["advisory"]},{"url":"https://github.com/librenms/librenms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-2728","description":"LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.","status":"published","published":"2026-04-13T10:39:54.757Z","modified":"2026-04-13T12:59:06.75Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:48:46.911326Z"}],"euvd":[{"id":"EUVD-2026-21907","description":"LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.","status":"published","published":"2026-04-13T10:39:54Z","modified":"2026-04-13T12:59:06Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:24:29.371024Z"}],"ghsa":[{"id":"GHSA-5gm9-622f-qcg5","title":"LibreNMS: Cross-Site Scripting in ShowConfigController","description":"### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability exists in the ShowConfig page of devices affected by the RANCID Integration settings. The application fails to properly sanitise the `rancid_repo_url` configuration value. When a user navigates to a device's configuration page, this unsanitised value is rendered directly within an HTML anchor (\u0026lt;a\u0026gt;) tag. This allows an authenticated user with permission to modify external settings to inject malicious JavaScript that will execute in the browser of any user viewing the affected device pages.\n\n### Details\nThe vulnerability is located in the external settings configuration block, specifically at the settings/external/rancid endpoint. When a valid rancid_configs is set, the application renders the corresponding `rancid_repo_url` as a clickable link labeled \"Git Repository\" on the `/device/{id}/showconfig` UI.\n\nBecause the `rancid_repo_url` input is neither validated upon saving nor contextually encoded upon rendering, an attacker can break out of the `href` attribute context or use JavaScript URIs to attach malicious event handlers or scripts.\n\nThis vulnerability is introduced by the line 13 of https://github.com/librenms/librenms/blob/master/includes/html/pages/device/showconfig.inc.php.\n\n### PoC\n1. Login as an admin and navigate to `/settings/external/rancid`.\n\u003cimg width=\"790\" height=\"155\" alt=\"image\" src=\"https://github.com/user-attachments/assets/348fff1b-dfce-4735-9273-055113695368\" /\u003e\n\n2. Add a valid path to `rancid_configs`. This can be any directory ended with `.git`. \n3. Put `\"\u003e\u003c/a\u003e\u003cimg/src/onerror=alert(1)\u003e\u003ca x=\"` into `rancid_repo_url` config.\n\u003cimg width=\"909\" height=\"276\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b8c5d650-ba05-4326-8a2d-bea8defa7373\" /\u003e\n\n4. Navigate to a device page and click `Config` (Or visit `/device/{id}/showconfig` directly).\n5. The XSS is triggered when visiting the page. It will pop up an alert dialog.\n\u003cimg width=\"810\" height=\"454\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4d15784e-ff93-46ec-b13e-08a225a8d6d4\" /\u003e\n\n#### Other Payloads\n\n- `javascript:alert(1)\" x=\"` - triggered by clicking the link.\n- ``\" onmouseover=\"alert(1)\" x=\"` - triggered by hovering on the link\n\n### Impact\nSince an admin account is required to change the settings, the risk is minimal in systems with a single administrator. However, in environments with multiple administrative users, this constitutes an Admin-to-Admin Cross-Site Scripting attack. It could be used by a compromised admin account to execute arbitrary frontend code in the context of another administrator's session, potentially leading to session hijacking or unauthorized data exposure.\n\n### Remediation Advice\nEnsure proper sanitisation is performed on affected fields, with all special characters escaped and HTML encoded. This can be done with existing frameworks like HTMLPurifier.\n\n### CVE Request\nCVE References: https://projectblack.io/blog/librenms-authenticated-rce-and-xss/","status":"published","published":"2026-05-18T17:00:49Z","modified":"2026-05-18T17:00:49Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:11.298154Z"},{"id":"GHSA-rp7w-624x-95qv","title":"Duplicate Advisory: LibreNMS affected by an authenticated Cross-site Scripting vulnerability on the showconfig page","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-5gm9-622f-qcg5. This link is maintained to preserve external references.\n\n## Original Description\nLibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.","status":"withdrawn","published":"2026-04-13T12:31:15Z","modified":"2026-05-12T13:39:52Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:07.01746Z"}],"nvd":[{"id":"CVE-2026-2728","description":"LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.","status":"published","published":"2026-04-13T11:16:05.407Z","modified":"2026-06-17T10:31:36.85Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"CVE-2026-2728","description":"LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.","status":"published","published":"2026-04-13T10:39:54.757Z","modified":"2026-10-28T02:31:11.622790923Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"GHSA-5gm9-622f-qcg5","title":"LibreNMS: Cross-Site Scripting in ShowConfigController","description":"### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability exists in the ShowConfig page of devices affected by the RANCID Integration settings. The application fails to properly sanitise the `rancid_repo_url` configuration value. When a user navigates to a device's configuration page, this unsanitised value is rendered directly within an HTML anchor (\u0026lt;a\u0026gt;) tag. This allows an authenticated user with permission to modify external settings to inject malicious JavaScript that will execute in the browser of any user viewing the affected device pages.\n\n### Details\nThe vulnerability is located in the external settings configuration block, specifically at the settings/external/rancid endpoint. When a valid rancid_configs is set, the application renders the corresponding `rancid_repo_url` as a clickable link labeled \"Git Repository\" on the `/device/{id}/showconfig` UI.\n\nBecause the `rancid_repo_url` input is neither validated upon saving nor contextually encoded upon rendering, an attacker can break out of the `href` attribute context or use JavaScript URIs to attach malicious event handlers or scripts.\n\nThis vulnerability is introduced by the line 13 of https://github.com/librenms/librenms/blob/master/includes/html/pages/device/showconfig.inc.php.\n\n### PoC\n1. Login as an admin and navigate to `/settings/external/rancid`.\n\u003cimg width=\"790\" height=\"155\" alt=\"image\" src=\"https://github.com/user-attachments/assets/348fff1b-dfce-4735-9273-055113695368\" /\u003e\n\n2. Add a valid path to `rancid_configs`. This can be any directory ended with `.git`. \n3. Put `\"\u003e\u003c/a\u003e\u003cimg/src/onerror=alert(1)\u003e\u003ca x=\"` into `rancid_repo_url` config.\n\u003cimg width=\"909\" height=\"276\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b8c5d650-ba05-4326-8a2d-bea8defa7373\" /\u003e\n\n4. Navigate to a device page and click `Config` (Or visit `/device/{id}/showconfig` directly).\n5. The XSS is triggered when visiting the page. It will pop up an alert dialog.\n\u003cimg width=\"810\" height=\"454\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4d15784e-ff93-46ec-b13e-08a225a8d6d4\" /\u003e\n\n#### Other Payloads\n\n- `javascript:alert(1)\" x=\"` - triggered by clicking the link.\n- ``\" onmouseover=\"alert(1)\" x=\"` - triggered by hovering on the link\n\n### Impact\nSince an admin account is required to change the settings, the risk is minimal in systems with a single administrator. However, in environments with multiple administrative users, this constitutes an Admin-to-Admin Cross-Site Scripting attack. It could be used by a compromised admin account to execute arbitrary frontend code in the context of another administrator's session, potentially leading to session hijacking or unauthorized data exposure.\n\n### Remediation Advice\nEnsure proper sanitisation is performed on affected fields, with all special characters escaped and HTML encoded. This can be done with existing frameworks like HTMLPurifier.\n\n### CVE Request\nCVE References: https://projectblack.io/blog/librenms-authenticated-rce-and-xss/","status":"published","published":"2026-05-18T17:00:49Z","modified":"2026-05-18T17:26:25.609485Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GHSA-rp7w-624x-95qv","title":"Duplicate Advisory: LibreNMS affected by an authenticated Cross-site Scripting vulnerability on the showconfig page","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-5gm9-622f-qcg5. This link is maintained to preserve external references.\n\n## Original Description\nLibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.","status":"withdrawn","published":"2026-04-13T12:31:15Z","modified":"2026-09-10T03:51:03.174232695Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}