{"id":"CVE-2026-55182","aliases":["EUVD-2026-66774","GHSA-c9fv-cgmm-2wg7"],"status":"published","title":"LibreNMS: Remote Code Execution by Signal Alert Transportation Module","description":"LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01607,"percentile":0.76236,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2026-08-18T17:59:56Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Packagist","package":"librenms/librenms","fixed_in":["26.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"librenms/librenms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.6.0"},{"fixed":"26.5.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"librenms/librenms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.6.0"},{"fixed":"26.5.0"}]}],"versions":["21.10.0","21.10.1","21.10.2","21.11.0","21.12.0","21.12.1","21.6.0","21.7.0","21.8.0","21.9.0","21.9.1","22.1.0","22.10.0","22.11.0","22.12.0","22.2.0","22.2.1","22.2.2","22.3.0","22.4.0","22.4.1","22.5.0","22.6.0","22.7.0","22.8.0","22.9.0","23.1.0","23.1.1","23.10.0","23.11.0","23.2.0","23.4.0","23.4.1","23.5.0","23.6.0","23.7.0","23.8.0","23.8.1","23.8.2","23.9.0","23.9.1","24.1.0","24.10.0","24.10.1","24.11.0","24.12.0","24.2.0","24.3.0","24.4.0","24.4.1","24.5.0","24.6.0","24.7.0","24.8.0","24.8.1","24.9.0","24.9.1","25.1.0","25.10.0","25.11.0","25.12.0","25.2.0","25.3.0","25.4.0","25.5.0","25.6.0","25.7.0","25.8.0","25.9.0","25.9.1","26.1.0","26.1.1","26.2.0","26.3.0","26.3.1","26.4.0","26.4.1"]}],"products":[{"vendor":"librenms","product":"librenms"}],"references":[{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/librenms/librenms/commit/868e3b966a","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/librenms/librenms/releases/tag/26.5.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-c9fv-cgmm-2wg7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55182.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55182","tags":["advisory"]},{"url":"https://github.com/librenms/librenms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55182","title":"LibreNMS: Remote Code Execution by Signal Alert Transportation Module","description":"LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.","status":"published","published":"2026-08-26T21:50:04.014Z","modified":"2026-08-27T13:47:10.632Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-66774","description":"LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.","status":"published","published":"2026-08-26T21:50:04Z","modified":"2026-08-27T13:47:10Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:28.581047Z"}],"ghsa":[{"id":"GHSA-c9fv-cgmm-2wg7","title":"LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module","description":"### Summary\nA vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.\n\n### Details\nThe vulnerability is caused by an unsafe `exec` call in `deliverAlert` function of `LibreNMS/Alert/Transport/Signal.php`. Escapes for the path of `signal-cli` and the `Recipient` field are insufficient to prevent command-line injection. \n\nThe `composer_wrapper.php` under `scripts` is also vulnerable to command injection (unsafe `exec` calls) by passing the injected command as an argument, and it is accepting arguments passed by `deliverAlert`.\n\nBy chaining these unsafe `exec` calls, malicious admin user can execute any executables in the server's filesystem.\n\n### PoC\n\n1. Under Dashboard -\u003e Alert -\u003e Alert Transports\n\n\u003cimg width=\"282\" height=\"273\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b72f55b0-b782-47d0-b4f7-75f498019345\" /\u003e\n\n2. Create a new Alert Transport entry.\n    a. Select `Signal` as `Transport type`.\n    b. Put `../scripts/composer_wrapper.php` into `Path`.\n    c. Put the command to execute under `Recipient` with `;` at the start and the end of string.\n\n\u003cimg width=\"767\" height=\"391\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5e34bfa8-4bd5-40cb-9624-0d40e40ccdc5\" /\u003e\n\n3. . Click `Save Transport`, and after the popup closed, click `Test Transport` button under `Action` of the created Alert Transport entry.\n\n\u003cimg width=\"172\" height=\"90\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7f83db07-fbf9-4be6-b247-533a6d7b9828\" /\u003e\n\n4. The command is executed.\n\u003cimg width=\"532\" height=\"216\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d595b0fe-10cc-4050-b4b9-d290b658689d\" /\u003e\n\n### Impact\nThis vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.\n\n### Remediation Advice\nEscape user inputs, and avoid passing them directly into `exec` function. (`scripts/composer_wrapper.php`)\nAvoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (`LibreNMS/Alert/Transport/Signal.php`)","status":"published","published":"2026-08-18T17:59:56Z","modified":"2026-08-18T17:59:58Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:41:03.602876Z"}],"nvd":[{"id":"CVE-2026-55182","description":"LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.","status":"published","published":"2026-08-26T22:16:24.95Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CVE-2026-55182","title":"LibreNMS: Remote Code Execution by Signal Alert Transportation Module","description":"LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.","status":"published","published":"2026-08-26T21:50:04.014Z","modified":"2026-10-28T02:30:48.540441066Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-c9fv-cgmm-2wg7","title":"LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module","description":"### Summary\nA vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.\n\n### Details\nThe vulnerability is caused by an unsafe `exec` call in `deliverAlert` function of `LibreNMS/Alert/Transport/Signal.php`. Escapes for the path of `signal-cli` and the `Recipient` field are insufficient to prevent command-line injection. \n\nThe `composer_wrapper.php` under `scripts` is also vulnerable to command injection (unsafe `exec` calls) by passing the injected command as an argument, and it is accepting arguments passed by `deliverAlert`.\n\nBy chaining these unsafe `exec` calls, malicious admin user can execute any executables in the server's filesystem.\n\n### PoC\n\n1. Under Dashboard -\u003e Alert -\u003e Alert Transports\n\n\u003cimg width=\"282\" height=\"273\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b72f55b0-b782-47d0-b4f7-75f498019345\" /\u003e\n\n2. Create a new Alert Transport entry.\n    a. Select `Signal` as `Transport type`.\n    b. Put `../scripts/composer_wrapper.php` into `Path`.\n    c. Put the command to execute under `Recipient` with `;` at the start and the end of string.\n\n\u003cimg width=\"767\" height=\"391\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5e34bfa8-4bd5-40cb-9624-0d40e40ccdc5\" /\u003e\n\n3. . Click `Save Transport`, and after the popup closed, click `Test Transport` button under `Action` of the created Alert Transport entry.\n\n\u003cimg width=\"172\" height=\"90\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7f83db07-fbf9-4be6-b247-533a6d7b9828\" /\u003e\n\n4. The command is executed.\n\u003cimg width=\"532\" height=\"216\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d595b0fe-10cc-4050-b4b9-d290b658689d\" /\u003e\n\n### Impact\nThis vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.\n\n### Remediation Advice\nEscape user inputs, and avoid passing them directly into `exec` function. (`scripts/composer_wrapper.php`)\nAvoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (`LibreNMS/Alert/Transport/Signal.php`)","status":"published","published":"2026-08-18T17:59:56Z","modified":"2026-08-18T18:50:02.547289Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}