CVE-2026-55182 (GCVE-0-2026-55182)
Vulnerability from cvelistv5 – Published: 2026-08-26 21:50 – Updated: 2026-08-27 13:47
VLAI
EPSS
VEX
Title
LibreNMS: Remote Code Execution by Signal Alert Transportation Module
Summary
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:47 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/librenms/librenms/security/adv… | x_refsource_CONFIRM |
| https://github.com/librenms/librenms/commit/868e3b966a | x_refsource_MISC |
| https://github.com/librenms/librenms/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55182",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:47:03.373245Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:47:10.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "librenms",
"vendor": "librenms",
"versions": [
{
"status": "affected",
"version": "\u003e= 21.6.0, \u003c 26.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T21:50:04.014Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
},
{
"name": "https://github.com/librenms/librenms/commit/868e3b966a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/librenms/librenms/commit/868e3b966a"
},
{
"name": "https://github.com/librenms/librenms/releases/tag/26.5.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/librenms/librenms/releases/tag/26.5.0"
}
],
"source": {
"advisory": "GHSA-c9fv-cgmm-2wg7",
"discovery": "UNKNOWN"
},
"title": "LibreNMS: Remote Code Execution by Signal Alert Transportation Module"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55182",
"datePublished": "2026-08-26T21:50:04.014Z",
"dateReserved": "2026-06-16T15:20:43.086Z",
"dateUpdated": "2026-08-27T13:47:10.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-55182",
"date": "2026-09-23",
"epss": "0.01128",
"percentile": "0.64959"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "librenms",
"vendor": "librenms",
"versions": [
{
"status": "affected",
"version": "\u003e= 21.6.0, \u003c 26.5.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0."
}
],
"id": "CVE-2026-55182",
"lastModified": "2026-09-09T21:09:13.080",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-55182",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:47:03.373245Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-26T22:16:24.950",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/librenms/librenms/commit/868e3b966a"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/librenms/librenms/releases/tag/26.5.0"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55182",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:47:03.373245Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:46:41.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "librenms",
"vendor": "librenms",
"versions": [
{
"status": "affected",
"version": "\u003e= 21.6.0, \u003c 26.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T21:50:04.014Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
},
{
"name": "https://github.com/librenms/librenms/commit/868e3b966a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/librenms/librenms/commit/868e3b966a"
},
{
"name": "https://github.com/librenms/librenms/releases/tag/26.5.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/librenms/librenms/releases/tag/26.5.0"
}
],
"source": {
"advisory": "GHSA-c9fv-cgmm-2wg7",
"discovery": "UNKNOWN"
},
"title": "LibreNMS: Remote Code Execution by Signal Alert Transportation Module"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55182",
"datePublished": "2026-08-26T21:50:04.014Z",
"dateReserved": "2026-06-16T15:20:43.086Z",
"dateUpdated": "2026-08-27T13:47:10.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
CERTFR-2026-AVI-0732
Vulnerability from certfr_avis - Published: 2026-06-11 - Updated: 2026-08-10
Une vulnérabilité a été découverte dans LibreNMS. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Librenms versions 21.6.x \u00e0 26.x ant\u00e9rieures \u00e0 26.5.0",
"product": {
"name": "LibreNMS",
"vendor": {
"name": "LibreNMS",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-55182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55182"
}
],
"initial_release_date": "2026-06-11T00:00:00",
"last_revision_date": "2026-08-10T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0732",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-11T00:00:00.000000"
},
{
"description": "L\u0027avis \u00e9diteur ne mentionne qu\u0027une vuln\u00e9rabilit\u00e9.",
"revision_date": "2026-06-12T00:00:00.000000"
},
{
"description": "Ajout r\u00e9f\u00e9rence CVE-2026-55182 ",
"revision_date": "2026-08-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans LibreNMS. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
"title": "Vuln\u00e9rabilit\u00e9 dans LibreNMS",
"vendor_advisories": [
{
"published_at": "2026-06-10",
"title": "Bulletin de s\u00e9curit\u00e9 LibreNMS GHSA-c9fv-cgmm-2wg7",
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
}
]
}
FKIE_CVE-2026-55182
Vulnerability from fkie_nvd - Published: 2026-08-26 22:16 - Updated: 2026-09-09 21:09
Severity
Summary
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "librenms",
"vendor": "librenms",
"versions": [
{
"status": "affected",
"version": "\u003e= 21.6.0, \u003c 26.5.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0."
}
],
"id": "CVE-2026-55182",
"lastModified": "2026-09-09T21:09:13.080",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-55182",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:47:03.373245Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-26T22:16:24.950",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/librenms/librenms/commit/868e3b966a"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/librenms/librenms/releases/tag/26.5.0"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-C9FV-CGMM-2WG7
Vulnerability from github – Published: 2026-08-18 17:59 – Updated: 2026-08-18 17:59
VLAI
Summary
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
Details
Summary
A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.
Details
The vulnerability is caused by an unsafe exec call in deliverAlert function of LibreNMS/Alert/Transport/Signal.php. Escapes for the path of signal-cli and the Recipient field are insufficient to prevent command-line injection.
The composer_wrapper.php under scripts is also vulnerable to command injection (unsafe exec calls) by passing the injected command as an argument, and it is accepting arguments passed by deliverAlert.
By chaining these unsafe exec calls, malicious admin user can execute any executables in the server's filesystem.
PoC
- Under Dashboard -> Alert -> Alert Transports
- Create a new Alert Transport entry.
a. Select
SignalasTransport type. b. Put../scripts/composer_wrapper.phpintoPath. c. Put the command to execute underRecipientwith;at the start and the end of string.
- . Click
Save Transport, and after the popup closed, clickTest Transportbutton underActionof the created Alert Transport entry.
- The command is executed.
Impact
This vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.
Remediation Advice
Escape user inputs, and avoid passing them directly into exec function. (scripts/composer_wrapper.php)
Avoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (LibreNMS/Alert/Transport/Signal.php)
Severity
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "librenms/librenms"
},
"ranges": [
{
"events": [
{
"introduced": "21.6.0"
},
{
"fixed": "26.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55182"
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-18T17:59:56Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nA vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.\n\n### Details\nThe vulnerability is caused by an unsafe `exec` call in `deliverAlert` function of `LibreNMS/Alert/Transport/Signal.php`. Escapes for the path of `signal-cli` and the `Recipient` field are insufficient to prevent command-line injection. \n\nThe `composer_wrapper.php` under `scripts` is also vulnerable to command injection (unsafe `exec` calls) by passing the injected command as an argument, and it is accepting arguments passed by `deliverAlert`.\n\nBy chaining these unsafe `exec` calls, malicious admin user can execute any executables in the server\u0027s filesystem.\n\n### PoC\n\n1. Under Dashboard -\u003e Alert -\u003e Alert Transports\n\n\u003cimg width=\"282\" height=\"273\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b72f55b0-b782-47d0-b4f7-75f498019345\" /\u003e\n\n2. Create a new Alert Transport entry.\n a. Select `Signal` as `Transport type`.\n b. Put `../scripts/composer_wrapper.php` into `Path`.\n c. Put the command to execute under `Recipient` with `;` at the start and the end of string.\n\n\u003cimg width=\"767\" height=\"391\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5e34bfa8-4bd5-40cb-9624-0d40e40ccdc5\" /\u003e\n\n3. . Click `Save Transport`, and after the popup closed, click `Test Transport` button under `Action` of the created Alert Transport entry.\n\n\u003cimg width=\"172\" height=\"90\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7f83db07-fbf9-4be6-b247-533a6d7b9828\" /\u003e\n\n4. The command is executed.\n\u003cimg width=\"532\" height=\"216\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d595b0fe-10cc-4050-b4b9-d290b658689d\" /\u003e\n\n### Impact\nThis vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.\n\n### Remediation Advice\nEscape user inputs, and avoid passing them directly into `exec` function. (`scripts/composer_wrapper.php`)\nAvoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (`LibreNMS/Alert/Transport/Signal.php`)",
"id": "GHSA-c9fv-cgmm-2wg7",
"modified": "2026-08-18T17:59:56Z",
"published": "2026-08-18T17:59:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-c9fv-cgmm-2wg7"
},
{
"type": "PACKAGE",
"url": "https://github.com/librenms/librenms"
},
{
"type": "WEB",
"url": "https://github.com/librenms/librenms/releases/tag/26.5.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…