{"id":"CVE-2026-2728","aliases":["GHSA-5gm9-622f-qcg5"],"url":"https://o3.security/vulnerability/CVE-2026-2728","summary":"LibreNMS: Cross-Site Scripting in ShowConfigController","details":"### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability exists in the ShowConfig page of devices affected by the RANCID Integration settings. The application fails to properly sanitise the `rancid_repo_url` configuration value. When a user navigates to a device's configuration page, this unsanitised value is rendered directly within an HTML anchor (<a>) tag. This allows an authenticated user with permission to modify external settings to inject malicious JavaScript that will execute in the browser of any user viewing the affected device pages.\n\n### Details\nThe vulnerability is located in the external settings configuration block, specifically at the settings/external/rancid endpoint. When a valid rancid_configs is set, the application renders the corresponding `rancid_repo_url` as a clickable link labeled \"Git Repository\" on the `/device/{id}/showconfig` UI.\n\nBecause the `rancid_repo_url` input is neither validated upon saving nor contextually encoded upon rendering, an attacker can break out of the `href` attribute context or use JavaScript URIs to attach malicious event handlers or scripts.\n\nThis vulnerability is introduced by the line 13 of https://github.com/librenms/librenms/blob/master/includes/html/pages/device/showconfig.inc.php.\n\n### PoC\n1. Login as an admin and navigate to `/settings/external/rancid`.\n\"image\"\n\n2. Add a valid path to `rancid_configs`. This can be any directory ended with `.git`. \n3. Put `\">\n\n4. Navigate to a device page and click `Config` (Or visit `/device/{id}/showconfig` directly).\n5. The XSS is triggered when visiting the page. It will pop up an alert dialog.\n\"image\"\n\n#### Other Payloads\n\n- `javascript:alert(1)\" x=\"` - triggered by clicking the link.\n- ``\" onmouseover=\"alert(1)\" x=\"` - triggered by hovering on the link\n\n### Impact\nSince an admin account is required to change the settings, the risk is minimal in systems with a single administrator. However, in environments with multiple administrative users, this constitutes an Admin-to-Admin Cross-Site Scripting attack. It could be used by a compromised admin account to execute arbitrary frontend code in the context of another administrator's session, potentially leading to session hijacking or unauthorized data exposure.\n\n### Remediation Advice\nEnsure proper sanitisation is performed on affected fields, with all special characters escaped and HTML encoded. This can be done with existing frameworks like HTMLPurifier.\n\n### CVE Request\nCVE References: https://projectblack.io/blog/librenms-authenticated-rce-and-xss/","published":"2026-04-13T10:39:54.757Z","modified":"2026-08-12T03:51:13.429173318Z","cvss":null,"epss":{"score":0.00225,"percentile":0.13389,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"librenms/librenms","fixedVersion":"26.3.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2728.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2728"},{"type":"EVIDENCE","url":"https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#xss-on-showconfig-page-2630"},{"type":"WEB","url":"https://github.com/librenms/librenms/security/advisories/GHSA-5gm9-622f-qcg5"},{"type":"PACKAGE","url":"https://github.com/librenms/librenms"},{"type":"WEB","url":"https://github.com/librenms/librenms/releases/tag/26.3.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:13.429173318Z"}}