Sign in
Deutsch English Español Polski
High

LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

  • Disclosed: 18.08.2026
  • Updated: 11.10.2026 10:22

Summary

A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.

Details

The vulnerability is caused by an unsafe exec call in deliverAlert function of LibreNMS/Alert/Transport/Signal.php. Escapes for the path of signal-cli and the Recipient field are insufficient to prevent command-line injection.

The composer_wrapper.php under scripts is also vulnerable to command injection (unsafe exec calls) by passing the injected command as an argument, and it is accepting arguments passed by deliverAlert.

By chaining these unsafe exec calls, malicious admin user can execute any executables in the server's filesystem.

PoC

  1. Under Dashboard -> Alert -> Alert Transports
<img width="282" height="273" alt="image" src="https://github.com/user-attachments/assets/b72f55b0-b782-47d0-b4f7-75f498019345" />
  1. Create a new Alert Transport entry. a. Select Signal as Transport type. b. Put ../scripts/composer_wrapper.php into Path. c. Put the command to execute under Recipient with ; at the start and the end of string.
<img width="767" height="391" alt="image" src="https://github.com/user-attachments/assets/5e34bfa8-4bd5-40cb-9624-0d40e40ccdc5" />
  1. . Click Save Transport, and after the popup closed, click Test Transport button under Action of the created Alert Transport entry.
<img width="172" height="90" alt="image" src="https://github.com/user-attachments/assets/7f83db07-fbf9-4be6-b247-533a6d7b9828" />
  1. The command is executed. <img width="532" height="216" alt="image" src="https://github.com/user-attachments/assets/d595b0fe-10cc-4050-b4b9-d290b658689d" />

Impact

This vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Remediation Advice

Escape user inputs, and avoid passing them directly into exec function. (scripts/composer_wrapper.php) Avoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (LibreNMS/Alert/Transport/Signal.php)

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package librenms/librenms >= 21.6.0, < 26.5.0 26.5.0

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-77
Platform
Composer
Package
librenms/librenms
Disclosed
18.08.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-c9fv-cgmm-2wg7 - CC BY 4.0

Vulnerability history: librenms/librenms

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (106) in the archive
Total entries
106
First → latest
10.2019 08.2026
Without a fix
6
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 39
  • Medium 56
  • Low 6

Disclosures per year

Severity:
  1. LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
    High · 7.1 CVE-2026-84192 < 26.5.0 26.5.0
  2. LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
    High · 8.1 CVE-2026-84189 < 26.7.0 26.7.0
  3. LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module this entry
    High CVE-2026-55182 >= 21.6.0, < 26.5.0 26.5.0
  4. LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
    High CVE-2026-6204 >= 1.48, < 26.3.0 26.3.0
  5. LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php
    High · 8.8 CVE-2026-26990 < 26.2.0 26.2.0
  6. LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.
    High CVE-2026-26988 < 26.2.0 26.2.0
  7. LibreNMS contains an authenticated SQL Injection vulnerability
    High · 7.1 CVE-2020-36947 <= 1.46 no fix
  8. LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE
    High · 7.5 CVE-2025-54138 < 25.7.0 25.7.0
  9. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php
    High · 7.5 CVE-2024-52526 < 24.10.0 24.10.0
  10. LibreNMS has an Authenticated OS Command Injection
    Critical · 9.1 CVE-2024-51092 < 24.10.0 24.10.0
  11. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php
    High · 7.5 CVE-2024-51497 < 24.10.0 24.10.0
  12. LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php
    High · 7.5 CVE-2024-51496 < 24.10.0 24.10.0
  13. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php
    High · 7.5 CVE-2024-51495 < 24.10.0 24.10.0
  14. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php
    High · 7.5 CVE-2024-51494 < 24.10.0 24.10.0
  15. LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints
    High · 7.2 CVE-2024-50355 < 24.10.0 24.10.0
  16. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php
    High · 7.5 CVE-2024-50352 < 24.10.0 24.10.0
  17. LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php
    High · 7.5 CVE-2024-50351 < 24.10.0 24.10.0
  18. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php
    High · 7.5 CVE-2024-50350 < 24.10.0 24.10.0
  19. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php
    High · 7.5 CVE-2024-49764 < 24.10.0 24.10.0
  20. Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php
    High · 7.5 CVE-2024-49759 < 24.10.0 24.10.0
  21. LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php
    High · 7.5 CVE-2024-49754 < 24.10.0 24.10.0
  22. LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name
    High · 7.2 CVE-2024-47524 < 24.9.0 24.9.0
  23. LibreNMS vulnerable to a Time-Based Blind SQL injection leads to database extraction
    High · 7.2 CVE-2024-32480 < 24.4.0 24.4.0
  24. LibreNMS uses Improper Sanitization on Service template name leads to Stored XSS
    High · 7.1 CVE-2024-32479 < 24.4.0 24.4.0
  25. LibreNMS vulnerable to SQL injection time-based leads to database extraction
    High · 8.8 CVE-2024-32461 < 24.4.0 24.4.0
  26. SQL injection in librenms/librenms
    High · 7.8 CVE-2023-5591 < 23.10.0 23.10.0
  27. Cross site scripting in librenms
    High · 8.4 CVE-2023-5060 < 23.9.1 23.9.1
  28. LibreNMS Cross-site Scripting vulnerability
    High · 7.6 CVE-2023-4347 < 23.8.0 23.8.0
  29. Deserialization of Untrusted Data in librenms/librenms
    High · 8.8 CVE-2022-3525 < 22.10.0 22.10.0
  30. Cross-site Scripting in librenms/librenms
    High · 7.6 CVE-2022-4068 < 22.10.0 22.10.0
  31. Insufficient Session Expiration in librenms/librenms
    Critical · 9.8 CVE-2022-4070 < 22.10.0 22.10.0
  32. Command injection in librenms
    High CVE-2022-29712 < 22.4.0 22.4.0
  33. LibreNMS Information Disclosure
    Critical · 9.8 CVE-2019-10665 <= 1.47 no fix
  34. LibreNMS arbitrary OS commands execution
    Critical · 9.8 CVE-2018-20434 = 1.46 no fix
  35. LibreNMS SQL Injection
    High · 8.8 CVE-2018-20678 < 1.65 1.65
  36. Improper Access Control in librenms
    High · 7.1 CVE-2022-0580 < 22.2.0 22.2.0
  37. Improper Authorization in librenms
    High · 7.1 CVE-2022-0587 < 22.2.0 22.2.0
  38. Path traversal in librenms/librenms
    Critical · 9.8 CVE-2021-44278 <= 21.11.0 no fix
  39. Exposure of Resource to Wrong Sphere in LibreNMS
    High · 8.8 CVE-2020-15877 < 1.65.1 1.65.1
  40. SQL Injection in librenms
    High · 8.8 CVE-2020-35700 < 21.1.0 21.1.0
Show more (4) Showing 40 of 44

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.