A Reflected Cross-Site Scripting (XSS) vulnerability exists in LibreNMS at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without proper encoding, allowing execution of arbitrary JavaScript when a crafted URL is visited. This can lead to session hijacking and unauthorized actions via script execution. The vulnerability affects versions prior to 25.11.0 and has been fixed in version 25.11.0.