CVE-2026-30480: LibreNMS Path Traversal Vulnerability

CVE-2026-30480 Overview

A Local File Inclusion (LFI) vulnerability exists in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2. This vulnerability allows authenticated attackers to include arbitrary PHP files from the server filesystem by using path traversal sequences in the nfsen parameter. Successful exploitation could lead to unauthorized access to sensitive server files, potentially exposing configuration data, credentials, and other confidential information.

Critical Impact

Authenticated attackers can read arbitrary files from the server filesystem, potentially exposing sensitive configuration files, credentials, and application source code through path traversal exploitation.

Affected Products

• LibreNMS 22.11.0-23-gd091788f2
• LibreNMS versions with vulnerable NFSen module (nfsen.inc.php)

Discovery Timeline

• April 14, 2026 - CVE-2026-30480 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-30480

Vulnerability Analysis

This Local File Inclusion vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The vulnerability exists due to improper validation of user-supplied input in the NFSen module of LibreNMS. When processing the nfsen parameter, the application fails to properly sanitize path traversal sequences (such as ../), allowing authenticated users to escape the intended directory and include arbitrary PHP files from anywhere on the server filesystem.

The attack is network-based and requires low complexity to execute, though authentication is required. The primary impact is on confidentiality, as attackers can read sensitive files but cannot directly modify data or cause system unavailability through this vulnerability alone.

Root Cause

The root cause of this vulnerability lies in the nfsen.inc.php file within the LibreNMS NFSen module. The code fails to implement proper input validation and sanitization on the nfsen parameter before using it in file inclusion operations. Specifically, the application does not strip or reject directory traversal sequences such as ../ or absolute paths, allowing attackers to manipulate the file path to access files outside the intended directory structure.

Attack Vector

The attack vector is network-based and requires an authenticated session to the LibreNMS application. An attacker with valid credentials can craft malicious requests containing path traversal sequences in the nfsen parameter. By including sequences like ../../etc/passwd or similar traversal patterns, the attacker can force the PHP interpreter to include and potentially expose contents of sensitive server files.

The vulnerability requires low attack complexity as no special conditions are needed beyond authentication. The attacker sends a crafted HTTP request to the vulnerable endpoint, and the server processes the malicious path, returning the contents of the requested file or executing PHP code if a PHP file is included.

For technical details and proof-of-concept information, see the GitHub PoC Repository.

Detection Methods for CVE-2026-30480

Indicators of Compromise

• HTTP requests to NFSen-related endpoints containing path traversal sequences such as ../, ..%2f, or ..%252f in the nfsen parameter
• Unusual file access patterns in web server logs showing attempts to access system files like /etc/passwd, /etc/shadow, or application configuration files
• Access to nfsen.inc.php with suspicious or malformed parameter values
• Elevated authentication activity followed by unusual file read operations

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP request parameters
• Configure intrusion detection systems to alert on path traversal sequences targeting the NFSen module endpoints
• Enable detailed logging for the LibreNMS application and monitor for anomalous file access requests
• Deploy endpoint detection solutions capable of identifying LFI exploitation attempts

Monitoring Recommendations

• Monitor web server access logs for requests containing directory traversal patterns (../, encoded variants)
• Set up alerts for access attempts to sensitive system files through web application requests
• Review authentication logs for accounts accessing NFSen module functionality
• Implement file integrity monitoring on critical configuration and credential files

How to Mitigate CVE-2026-30480

Immediate Actions Required

• Review and restrict access to the NFSen module for only essential users who require this functionality
• Implement web application firewall rules to block requests containing path traversal sequences
• Audit user accounts with access to LibreNMS and disable any suspicious or unnecessary accounts
• Isolate the LibreNMS server from sensitive internal network resources where possible

Patch Information

Organizations should monitor the official LibreNMS project for security patches addressing this vulnerability. Check the LibreNMS GitHub repository and official documentation for updated versions that remediate CVE-2026-30480. Apply security updates as soon as they become available.

For additional information, refer to the GitHub PoC Repository which may contain details about the vulnerability disclosure and vendor response.

Workarounds

• Disable or remove the NFSen module if it is not required for network monitoring operations
• Implement additional input validation at the web server or reverse proxy level to reject requests with path traversal patterns
• Restrict filesystem permissions on sensitive files to prevent the web server user from reading them
• Use PHP configuration options like open_basedir to limit file access to specific directories

# Example: Configure PHP open_basedir restriction in php.ini or vhost config
# Limit PHP file operations to LibreNMS directory only
php_admin_value open_basedir "/opt/librenms/:/tmp/"

# Example: Apache mod_rewrite rule to block path traversal
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC]
RewriteRule .* - [F,L]