CVE-2025-62365: LibreNMS Reflected XSS Vulnerability

CVE-2025-62365 Overview

CVE-2025-62365 is a reflected cross-site scripting (XSS) vulnerability in LibreNMS, an open-source PHP/MySQL/SNMP-based network monitoring system. The flaw resides in the report_this function located in librenms/includes/functions.php. The function incorrectly applied htmlentities filtering within an href attribute context, allowing the project_issues configuration parameter to trigger script execution in the victim's browser. All LibreNMS releases prior to 25.7.0 are affected, and the maintainers resolved the issue by removing the vulnerable function entirely.

Critical Impact
An attacker can craft a malicious URL or manipulate the project_issues value to execute arbitrary JavaScript in an authenticated LibreNMS user's browser, enabling session theft or unauthorized actions [CWE-79].

Affected Products

LibreNMS versions prior to 25.7.0
Deployments referencing project_issues through the report_this helper
Any LibreNMS instance rendering device alerts pages with the vulnerable function

Discovery Timeline

2025-10-13 - CVE-2025-62365 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62365

Vulnerability Analysis

The vulnerability is a reflected XSS classified under [CWE-79]. The report_this function generated an HTML heading containing an anchor tag whose href attribute was populated with the project_issues configuration value. While htmlentities was applied to the value, the function did not use the appropriate flags for attribute context, leaving quote characters improperly encoded for use inside an href. An attacker able to influence or set project_issues can inject a javascript: URI or attribute-breaking payload that executes when a LibreNMS user clicks the rendered link.

The reachable call site in includes/html/pages/device/alerts.inc.php invoked report_this('Unknown section ' . $vars['section']) from the device alerts view, providing an authenticated pathway to render the tainted output.

Root Cause

The root cause is improper output encoding for HTML attribute context. htmlentities was called without ENT_QUOTES semantics suitable for href values, and no URL scheme validation was performed on project_issues. As a result, an attacker-controlled string flowed directly into a hyperlink target rendered in the browser.

Attack Vector

Exploitation requires a victim to visit a LibreNMS page that invokes report_this, such as the device alerts view with an unknown section parameter. The attacker either supplies a crafted section value or influences the project_issues configuration to embed a javascript: payload. When the page renders, the malicious anchor executes script in the LibreNMS session context.

php

// Vulnerable function removed in the 25.7.0 patch
-function report_this($message)
-{
-    return '<h2>' . htmlentities($message) . ' Please <a href="' . htmlentities(Config::get('project_issues')) . '">report this</a> to the ' . htmlentities(Config::get('project_name')) . ' developers.</h2>';
-}//end report_this()

// Reachable call site replaced with a static string
-echo report_this('Unknown section ' . $vars['section']);
+echo 'Unknown section';

Source: GitHub Commit 30d3dd7

Detection Methods for CVE-2025-62365

Indicators of Compromise

Web server access logs showing requests to device alerts pages with unusual section query parameters containing HTML or javascript: payloads
LibreNMS configuration entries where project_issues contains non-HTTPS schemes or embedded quote characters
Outbound requests from user browsers to attacker-controlled hosts immediately after loading LibreNMS pages

Detection Strategies

Inspect HTTP request parameters to /device/ alert routes for encoded angle brackets, onerror=, or javascript: substrings
Review LibreNMS configuration history for unauthorized modification of project_issues or project_name
Compare deployed LibreNMS version against 25.7.0 using package inventory data

Monitoring Recommendations

Enable web application firewall (WAF) rules that flag reflected XSS patterns targeting LibreNMS URIs
Alert on configuration changes to LibreNMS settings tables containing project_ keys
Correlate suspicious LibreNMS session activity with anomalous outbound browser traffic from operator workstations

How to Mitigate CVE-2025-62365

Immediate Actions Required

Upgrade LibreNMS to version 25.7.0 or later, which removes the vulnerable report_this function
Audit the project_issues configuration value and reset it to the trusted default https://github.com/librenms/librenms/issues
Restrict administrative access to the LibreNMS configuration interface to trusted operators only

Patch Information

The fix is delivered in commit 30d3dd7e5f5e22a8c23c9db3ad90a731c005b008 and included in LibreNMS 25.7.0. The patch deletes the report_this function and replaces its call site in includes/html/pages/device/alerts.inc.php with a static Unknown section string. See the GitHub Security Advisory GHSA-86rg-8hc8-v82p for advisory details.

Workarounds

Manually remove or replace the report_this function in includes/functions.php following the upstream patch
Set a strict Content Security Policy (CSP) that blocks inline script execution and javascript: URIs for the LibreNMS origin
Limit LibreNMS access to authenticated, trusted network segments until patching is complete

bash

# Upgrade LibreNMS to the fixed release
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 25.7.0
sudo -u librenms ./scripts/composer_wrapper.php install --no-dev
sudo systemctl restart php-fpm nginx