PT-2025-42520 · Librenms · Librenms

Published 2025-10-16 · Updated 2025-10-16 · CVE-2025-62412

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions 25.8.0 through 25.10.0

Description LibreNMS contains a flaw in the Alerts > Alert Rules page where the alert rule name is not properly sanitized. This allows for the injection of HTML code, potentially leading to Cross-Site Scripting (XSS). The vulnerability exists due to insufficient sanitization of the name parameter when creating or updating alert rules via a POST request to the /ajax form.php endpoint. The sanitization attempt using strip tags() can be bypassed using XML character references, such as <script>alert(1)</script>. The injected script is then executed when the bootgrid() function decodes these references during table rendering.

Recommendations LibreNMS version 25.10.0 resolves this issue. LibreNMS versions 25.8.0 and 25.9.0 are affected and should be updated.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62412

GHSA-6G2V-66CH-6XMH

Affected Products

Librenms

References · 10

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-6g2v-66ch-6xmh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62412.json · Exploit
• https://github.com/librenms/librenms/commit/dccdf6769976a974d70f06a7ce8d5a846b29db6f · Patch
• https://osv.dev/vulnerability/CVE-2025-62412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62412 · Security Note
• https://osv.dev/vulnerability/GHSA-6g2v-66ch-6xmh · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://github.com/librenms/librenms/releases/tag/25.10.0 · Note
• https://twitter.com/CVEnew/status/1978926566324220207 · Twitter Post
• https://t.me/CVEtracker/35134 · Telegram Post