Vulnerability · Published Jul 22, 2025 · Assigned by GitHub_M
CVE-2025-54138LibreNMS has Authenticated Local File Inclusion in ajax_form.php that Allows RCE
High 7.5
In plain English
A high-severity security flaw in librenms from librenms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without validation or allowlisting. This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities. This is fixed in version 25.7.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | librenms/librenms | 25.7.0 | GHSA-gq96-8w38-hhj2 |
Affected products (as reported)
Weakness: CWE-98 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/librenms/librenms/security/advisories/GHSA-gq96-8w38-hhj2 x_refsource_CONFIRM
- https://github.com/librenms/librenms/pull/17990 x_refsource_MISC
- https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81 x_refsource_MISC
- https://github.com/librenms/librenms/releases/tag/25.7.0 x_refsource_MISC