CVE-2025-62365: LibreNMS Reflected XSS Vulnerability in report_this Function
Summary
CVE-2025-62365: LibreNMS is vulnerable to Reflected-XSS in report_this function. Affects librenms/librenms versions < 25.7.0. Fixed in 25.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides a robust platform for monitoring network devices, servers, and services. It offers features such as alerting, reporting, and performance metrics. However, like many web applications, it is susceptible to security vulnerabilities, including cross-site scripting (XSS) attacks, which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability arises from improper input filtering in the report_this function located in librenms/includes/functions.php. Specifically, the use of the htmlentities function was incorrectly applied in a context where it failed to adequately sanitize user input, allowing the project_issues parameter to be exploited. This can lead to reflected XSS attacks, where an attacker can inject malicious scripts that execute in the context of the user's browser, potentially leading to unauthorized access to sensitive information, session hijacking, or malware distribution.
How To Fix
Minimum fixed version
25.7.0
This is the first release that contains the fix.
composer require librenms/librenms:25.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to filter out dangerous protocols such as 'javascript:' and 'file:' from user inputs to prevent XSS attacks. This can be implemented in the input validation logic of the application.
Conclusion
The CVE-2025-62365 vulnerability in LibreNMS poses a significant risk due to its potential for reflected XSS attacks. It is crucial for users to update to the patched version 25.7.0 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary measure to protect against exploitation.
See every vulnerability recorded for librenms/librenms →
FAQ
The vulnerability is a reflected XSS issue that allows attackers to inject malicious scripts into web pages viewed by users.
If you are using LibreNMS version 25.6.0 or earlier, your installation is vulnerable. You can check your version in the application settings.
Exploitation of this vulnerability can lead to unauthorized access to user data, session hijacking, and execution of malicious scripts in user browsers.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. You can also check your application against known vulnerabilities using the Vulert playground.
If you cannot update immediately, implement input validation to filter out dangerous protocols and monitor your application for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
