Vulnerability · Published Aug 18, 2025 · Assigned by GitHub_M
CVE-2025-55296LibreNMS allows stored XSS in Alert Template name field
Medium 5.5
In plain English
A medium-severity cross-site scripting in librenms from librenms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 17.0% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template is rendered, potentially compromising other admin accounts. This vulnerability is fixed in 25.8.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | librenms/librenms | 25.8.0 | GHSA-vxq6-8cwm-wj99 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N