LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data… (CVE-2026-84192)

CVE-2026-84192 is a stored cross-site scripting vulnerability in LibreNMS before version 26.3.1. The issue arises from legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping, enabling an attacker controlling a monitored network device to inject arbitrary JavaScript. This script executes in the context of authenticated users viewing the affected pages, leading to a high-severity impact due to potential credential theft or session hijacking. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact.

An attacker with control over a monitored network device can inject malicious JavaScript code that executes in the browsers of authenticated LibreNMS users viewing the affected pages. This can lead to the compromise of user sessions or theft of sensitive information. The vulnerability does not affect availability and requires user interaction (viewing the page).

A fix is available in LibreNMS version 26.3.1. Users should upgrade to version 26.3.1 or later to remediate this vulnerability. No other mitigation or temporary workaround is indicated in the provided data.