LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0.

LibreNMS versions through 26.4.0 are vulnerable to stored/persistent cross-site scripting (XSS) due to improper output encoding of JSON fields returned by the admin-configurable Oxidized integration URL. Specifically, fields such as name, ip, model, author, and commit message are rendered into the device showconfig page without applying htmlspecialchars(). An administrator who configures the Oxidized URL to point at an attacker-controlled server (leveraging SSRF) can cause malicious JSON to be returned and stored, affecting all users who view any device's showconfig tab. The vulnerability requires administrator-level access to configure the malicious URL, but its impact extends to all users of the platform. The issue has been patched in LibreNMS version 26.7.0. References are available via the NVD, GitHub Security Advisory, and VulnCheck advisory pages.