GHSA-c9fv-cgmm-2wg7 CVE-2026-55182

LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

High Packagist

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 1.61%; Chance of exploitation in the next 30 days. Higher than 75.89% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Fix: 26.5.0; Upgrade librenms/librenms to this version or later

Description

Summary

A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.

Details

The vulnerability is caused by an unsafe exec call in deliverAlert function of LibreNMS/Alert/Transport/Signal.php. Escapes for the path of signal-cli and the Recipient field are insufficient to prevent command-line injection.

The composer_wrapper.php under scripts is also vulnerable to command injection (unsafe exec calls) by passing the injected command as an argument, and it is accepting arguments passed by deliverAlert.

By chaining these unsafe exec calls, malicious admin user can execute any executables in the server's filesystem.

PoC

Under Dashboard -> Alert -> Alert Transports

Create a new Alert Transport entry. a. Select Signal as Transport type. b. Put ../scripts/composer_wrapper.php into Path. c. Put the command to execute under Recipient with ; at the start and the end of string.

. Click Save Transport, and after the popup closed, click Test Transport button under Action of the created Alert Transport entry.

The command is executed. <img width="532" height="216" alt="image" src="https://github.com/user-attachments/assets/d595b0fe-10cc-4050-b4b9-d290b658689d" />

Impact

This vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Remediation Advice

Escape user inputs, and avoid passing them directly into exec function. (scripts/composer_wrapper.php) Avoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (LibreNMS/Alert/Transport/Signal.php)

Affected versions

Packagist

Package	Vulnerable	Fixed in
librenms/librenms	`>= 21.6.0, < 26.5.0`	`26.5.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

librenms/librenms Packagist → `26.5.0`

composer

composer require librenms/librenms:^26.5.0

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): High
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

How to prevent it

Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
Implementation: If possible, ensure that all external commands called from the program are statically created.
Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.

References

Packages

github.com/librenms/librenms

Timeline

Aug 18, 2026 Published
Sep 9, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-7w8c-qgxg-m7jx LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates	High	Also affects librenms/librenms
GHSA-7gww-x7fh-jf9j LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page	Critical	Also affects librenms/librenms
GHSA-7cj5-v4pp-v632 LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users	Medium	Also affects librenms/librenms
GHSA-jf24-8g2h-2wg7 LibreNMS Vulnerable to Remote Code Execution via AboutController	High	Also affects librenms/librenms
GHSA-jmqm-f8q4-v7wx LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment	Medium	Also affects librenms/librenms
GHSA-5gm9-622f-qcg5 LibreNMS: Cross-Site Scripting in ShowConfigController	Medium	Also affects librenms/librenms
GHSA-pr3g-phhr-h8fh LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write	High	Also affects librenms/librenms
GHSA-79q9-wc6p-cf92 LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php	High	Also affects librenms/librenms

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor