CVE-2026-55182
CVE-2026-55182 · LibreNMS: Remote Code Execution by Signal Alert Transportation Module
This page contains facts from public vulnerability sources. Check the original advisory before updating.
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.
CVSS 8.6 · High · EPSS 1.6% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
librenms
- Versions
- >= 21.6.0, < 26.5.0: Affected
No fix published
librenms/librenms Packagist
- Versions
- 21.10.0
- 21.10.1
- 21.10.2
- 21.11.0
- 21.12.0
- 21.12.1
- 21.6.0
- 21.7.0
- 21.8.0
- 21.9.0
- 21.9.1
- 22.1.0
- 22.10.0
- 22.11.0
- 22.12.0
- 22.2.0
- 22.2.1
- 22.2.2
- 22.3.0
- 22.4.0
- 22.4.1
- 22.5.0
- 22.6.0
- 22.7.0
- 22.8.0
- 22.9.0
- 23.1.0
- 23.1.1
- 23.10.0
- 23.11.0
- 23.2.0
- 23.4.0
- 23.4.1
- 23.5.0
- 23.6.0
- 23.7.0
- 23.8.0
- 23.8.1
- 23.8.2
- 23.9.0
- 23.9.1
- 24.1.0
- 24.10.0
- 24.10.1
- 24.11.0
- 24.12.0
- 24.2.0
- 24.3.0
- 24.4.0
- 24.4.1
- 24.5.0
- 24.6.0
- 24.7.0
- 24.8.0
- 24.8.1
- 24.9.0
- 24.9.1
- 25.1.0
- 25.10.0
- 25.11.0
- 25.12.0
- 25.2.0
- 25.3.0
- 25.4.0
- 25.5.0
- 25.6.0
- 25.7.0
- 25.8.0
- 25.9.0
- 25.9.1
- 26.1.0
- 26.1.1
- 26.2.0
- 26.3.0
- 26.3.1
- 26.4.0
- 26.4.1
- Affected ranges
- ECOSYSTEM: ≥ 21.6.0, < 26.5.0
Update to 26.5.0