Vulnerability · Published Apr 13, 2026 · Assigned by PRJBLK
CVE-2026-6204
High 8.5
In plain English
A high-severity OS command injection in librenms from librenms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.5% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)7.5%top 5.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | librenms/librenms | 26.3.0 | GHSA-pr3g-phhr-h8fh |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N