p PatchFirst

CVE-2026-26989

CVE-2026-26989 · LibreNMS has Stored XSS in Alert Rule

This page contains facts from public vulnerability sources. Check the original advisory before updating.

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.

CVSS 4.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • librenms

    Versions
    • < 26.2.0: Affected

    No fix published

  • librenms/librenms Packagist

    Versions
    • 1.19
    • 1.20
    • 1.20.1
    • 1.21
    • 1.22
    • 1.22.01
    • 1.23
    • 1.24
    • 1.25
    • 1.26
    • 1.27
    • 1.28
    • 1.29
    • 1.30
    • 1.30.01
    • 1.31
    • 1.31.01
    • 1.31.02
    • 1.31.03
    • 1.32
    • 1.32.01
    • 1.33
    • 1.33.01
    • 1.34
    • 1.35
    • 1.36
    • 1.36.01
    • 1.37
    • 1.38
    • 1.39
    • 1.40
    • 1.41
    • 1.42
    • 1.42.01
    • 1.43
    • 1.44
    • 1.45
    • 1.46
    • 1.47
    • 1.48
    • 1.48.1
    • 1.49
    • 1.50
    • 1.50.1
    • 1.51
    • 1.52
    • 1.53
    • 1.53.1
    • 1.54
    • 1.55
    • 1.56
    • 1.57
    • 1.58
    • 1.58.1
    • 1.59
    • 1.60
    • 1.61
    • 1.62
    • 1.62.1
    • 1.62.2
    • 1.63
    • 1.64
    • 1.64.1
    • 1.65
    • 1.65.1
    • 1.66
    • 1.67
    • 1.68
    • 1.69
    • 1.70.0
    • 1.70.1
    • 21.1.0
    • 21.10.0
    • 21.10.1
    • 21.10.2
    • 21.11.0
    • 21.12.0
    • 21.12.1
    • 21.2.0
    • 21.3.0
    • 21.4.0
    • 21.5.0
    • 21.5.1
    • 21.6.0
    • 21.7.0
    • 21.8.0
    • 21.9.0
    • 21.9.1
    • 22.1.0
    • 22.10.0
    • 22.11.0
    • 22.12.0
    • 22.2.0
    • 22.2.1
    • 22.2.2
    • 22.3.0
    • 22.4.0
    • 22.4.1
    • 22.5.0
    • 22.6.0
    • 22.7.0
    • 22.8.0
    • 22.9.0
    • 23.1.0
    • 23.1.1
    • 23.10.0
    • 23.11.0
    • 23.2.0
    • 23.4.0
    • 23.4.1
    • 23.5.0
    • 23.6.0
    • 23.7.0
    • 23.8.0
    • 23.8.1
    • 23.8.2
    • 23.9.0
    • 23.9.1
    • 24.1.0
    • 24.10.0
    • 24.10.1
    • 24.11.0
    • 24.12.0
    • 24.2.0
    • 24.3.0
    • 24.4.0
    • 24.4.1
    • 24.5.0
    • 24.6.0
    • 24.7.0
    • 24.8.0
    • 24.8.1
    • 24.9.0
    • 24.9.1
    • 25.1.0
    • 25.10.0
    • 25.11.0
    • 25.12.0
    • 25.2.0
    • 25.3.0
    • 25.4.0
    • 25.5.0
    • 25.6.0
    • 25.7.0
    • 25.8.0
    • 25.9.0
    • 25.9.1
    • 26.1.0
    • 26.1.1
    Affected ranges
    • ECOSYSTEM: < 26.2.0

    Update to 26.2.0

Original sources

Check your server →