CVE-2026-2728
CVE-2026-2728
This page contains facts from public vulnerability sources. Check the original advisory before updating.
LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.
CVSS 4.6 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
librenms
- Versions
- ≥ 0, < 26.3.0: Affected (custom)
Update to 26.3.0
librenms/librenms Packagist
- Versions
- 25.12.0
- 26.1.0
- 26.1.1
- 26.2.0
- Affected ranges
- ECOSYSTEM: ≥ 25.12.0, < 26.3.0
Update to 26.3.0