{"id":"CVE-2026-45694","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-45694","summary":"LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment","details":"### Summary\n`LegacyController.php:75` writes the page title into a `document.title` JS assignment using string interpolation. `apps/proxmox.inc.php` pushes `$vars['instance']` and `$vars['vmid']` (GET params, only `strip_tags()` applied) directly into `$pagetitle`. A single quote terminates the JS string, executing arbitrary script.\n\n### Details\n```php\n// LegacyController.php:75\n$html .= \"<script>\\ndocument.title = '$title';\\n</script>\";\n\n// proxmox.inc.php:38,42\n$pagetitle[] = $instance;     // GET ?instance=\n$pagetitle[] = $vars['vmid']; // GET ?vmid=\n```\n\n### PoC\n```\nhttp://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//\n\nConfirmed in response:\ndocument.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';\n```\n\n### Fix\n```php\n// LegacyController.php:75\n$html .= \"<script>\\ndocument.title = \" . json_encode($title) . \";\\n</script>\";\n```\nAlso wrap `$instance` and `$vars['vmid']` in `htmlspecialchars()` in proxmox.inc.php.\n\n### Prerequisite\nAny authenticated session. Victim must follow a crafted link.","published":"2026-08-12T15:16:22Z","modified":"2026-08-12T15:30:08.857770652Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"librenms/librenms","fixedVersion":"26.5.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/librenms/librenms/security/advisories/GHSA-jmqm-f8q4-v7wx"},{"type":"PACKAGE","url":"https://github.com/librenms/librenms"},{"type":"WEB","url":"https://github.com/librenms/librenms/releases/tag/26.5.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:30:08.857770652Z"}}