CVE-2025-54138: LibreNMS Remote Code Execution Vulnerability

CVE-2025-54138 Overview

CVE-2025-54138 is a Remote File Inclusion (RFI) vulnerability in LibreNMS, an auto-discovering PHP/MySQL/SNMP network monitoring platform. The flaw exists in the ajax_form.php endpoint, which dynamically includes .inc.php files from the includes/html/forms/ path based on the user-controlled type POST parameter. The application performs no validation or allowlisting on this input. Versions 25.6.0 and below are affected, and the issue is fixed in 25.7.0. The vulnerability is tracked under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Authenticated attackers who can stage a file in the trusted include path — via symlink, development misconfiguration, or chained vulnerabilities — can achieve Remote Code Execution on the LibreNMS host.

Affected Products

LibreNMS versions 25.6.0 and earlier
LibreNMS deployments using ajax_form.php for form rendering
Self-hosted LibreNMS instances exposing the web UI to authenticated users

Discovery Timeline

2025-07-22 - CVE-2025-54138 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54138

Vulnerability Analysis

The vulnerability resides in the ajax_form.php endpoint of LibreNMS. The endpoint accepts a type parameter from POST input and uses it directly to construct an include statement targeting files under includes/html/forms/. Because no allowlist or input validation is applied, an attacker who controls the type value can influence which file is included at runtime.

While the include path is restricted to a trusted directory, the absence of validation creates a latent Remote Code Execution vector. If an attacker can place or link a PHP file into the includes/html/forms/ directory through a symlink, a development misconfiguration, or a chained file-write vulnerability, the included file will execute under the LibreNMS web server context. This grants the attacker code execution with the privileges of the PHP process.

Root Cause

The root cause is unsafe dynamic file inclusion driven by untrusted input. The type POST parameter is concatenated into an include path without sanitization, normalization, or comparison against an explicit list of permitted form names. This pattern matches [CWE-98], where PHP include/require statements operate on attacker-influenced filenames.

Attack Vector

Exploitation requires network access to the LibreNMS web interface and low-privilege authentication. The attacker submits a crafted POST request to ajax_form.php with a manipulated type value pointing to an attacker-staged file inside the trusted include directory. Because LibreNMS is typically deployed in privileged network monitoring contexts with SNMP credentials and broad device reachability, successful RCE provides a strong pivot point into internal infrastructure.

No public proof-of-concept exploit code has been verified for this issue. Refer to the GitHub Security Advisory GHSA-gq96-8w38-hhj2 and the fix commit ec89714 for the technical specifics of the patched code path.

Detection Methods for CVE-2025-54138

Indicators of Compromise

POST requests to /ajax_form.php containing unusual or unexpected type parameter values that do not match known LibreNMS form identifiers.
Creation of new .inc.php files or symbolic links inside the includes/html/forms/ directory outside of an official release or upgrade.
PHP-FPM or Apache worker processes spawning shells, network listeners, or outbound connections from the LibreNMS host.

Detection Strategies

Monitor web server access logs for ajax_form.php requests with type values containing path characters, encoded sequences, or unknown form names.
Use file integrity monitoring on the LibreNMS application directory, especially includes/html/forms/, to identify unauthorized files or symlinks.
Correlate authenticated session activity with subsequent unexpected process execution by the web server user.

Monitoring Recommendations

Alert on outbound connections initiated by the PHP or web server process account on LibreNMS hosts.
Track LibreNMS audit logs for low-privilege accounts performing actions outside normal operator workflows.
Review filesystem permissions on includes/html/forms/ to confirm only the package manager or deployment automation can write to it.

How to Mitigate CVE-2025-54138

Immediate Actions Required

Upgrade LibreNMS to version 25.7.0 or later, which validates the type parameter against an allowlist before inclusion.
Restrict access to the LibreNMS web interface to trusted administrators and management networks until patching is complete.
Audit the includes/html/forms/ directory for any unexpected files, symlinks, or recently modified content.

Patch Information

The issue is fixed in LibreNMS 25.7.0. The remediation is implemented in commit ec89714 and was introduced through Pull Request #17990. Full advisory details are available in the GitHub Security Advisory GHSA-gq96-8w38-hhj2.

Workarounds

Place a web server rule that blocks or filters POST requests to ajax_form.php containing type values not on a known-good list.
Run LibreNMS under a low-privilege account with read-only access to includes/html/forms/ to prevent attacker-staged files in that directory.
Disable symbolic link following in the web server configuration for the LibreNMS document root to mitigate symlink-based staging.

bash

# Example Apache configuration hardening for the LibreNMS document root
<Directory /opt/librenms/html>
    Options -FollowSymLinks -Includes
    AllowOverride None
    Require all granted
</Directory>

# Verify installed LibreNMS version
cd /opt/librenms && ./lnms --version