PT-2025-30360 · Librenms · Librenms

Skraft9 · Published 2025-07-21 · Updated 2025-08-05 · CVE-2025-54138

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreNMS versions 25.6.0 and below

Description LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring system. Versions 25.6.0 and below contain an architectural vulnerability in the /ajax form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the includes/html/forms/ path without validation or allowlisting. This introduces a potential Remote Code Execution (RCE) vector if an attacker can stage a file in this include path, for example, via symlink or development misconfiguration.

Recommendations LibreNMS versions prior to 25.7.0 are affected.

• Implement strict allow listing or hardcoded routing instead of dynamically including user-supplied filenames.
• Avoid passing raw POST input into include once.
• Ensure the inclusion path is immutable and outside of attacker control.

Exploit

Fix

RCE

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-54138

GHSA-GQ96-8W38-HHJ2

Affected Products

Librenms

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54138.json · Exploit
• https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81 · Patch
• https://github.com/librenms/librenms/security/advisories/GHSA-gq96-8w38-hhj2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gq96-8w38-hhj2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54138 · Security Note
• https://github.com/librenms/librenms · Note
• https://github.com/librenms/librenms/pull/17990 · Note
• https://github.com/librenms/librenms/releases/tag/25.7.0 · Note
• https://t.me/cvetracker/28423 · Telegram Post
• https://t.me/cveNotify/130967 · Telegram Post
• https://twitter.com/UndercodeUpdate/status/1948062637264159051 · Twitter Post
• https://twitter.com/CVEnew/status/1947776821204017597 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1947855448977125756 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1949732383306957070 · Twitter Post