high7.2
CVE-2026-6204
LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand …
Impact
LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | librenms/librenms | >= 1.48, < 26.3.0 | 26.3.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Librenms | Librenms | before 26.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-pr3g-phhr-h8fh
- https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fh
- https://github.com/librenms/librenms/blob/master/app/Providers/AppServiceProvider.php#L169
- https://nvd.nist.gov/vuln/detail/CVE-2026-6204
- https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-poc