LibreNMS is affected by a critical command injection vulnerability that allows an authenticated administrator to execute arbitrary commands on the host system.

This vulnerability is a command injection flaw (CWE-77) triggered by improper sanitization of the signal-cli path and Recipient fields in the alert transport configuration. An authenticated administrator can leverage these fields to pass malicious input to an exec call, ultimately chaining execution through the composer_wrapper.php script.

The ability to execute arbitrary operating-system commands poses a severe risk to the confidentiality, integrity, and availability of the monitoring server. With a CVSS score of 8.6, this high-severity flaw could allow an attacker to gain full control over the LibreNMS host, leading to unauthorized data access, lateral movement within the network, or complete system compromise.

Immediate Action: Update the LibreNMS installation to version 26.5.0 or later, which contains the necessary input sanitization fixes.

Proactive Monitoring: Review audit logs for unusual configuration changes to alert transports and monitor system processes for unexpected child processes spawned by the web server user.

Compensating Controls: Restrict administrative access to the LibreNMS interface to trusted personnel only and implement strict egress filtering on the host to limit the potential impact of successful command execution.

Public Exploit Available: Unknown

Given the potential for full system compromise, organizations should prioritize the update to version 26.5.0. Although the exploit requires authenticated administrative access, the risk remains significant, and patching is the only definitive method to eliminate this command injection vector.