GHSA-JMQM-F8Q4-V7WX

Vulnerability from github – Published: 2026-08-12 15:16 – Updated: 2026-08-12 15:16
VLAI
Summary
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment
Details

Summary

LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars['instance'] and $vars['vmid'] (GET params, only strip_tags() applied) directly into $pagetitle. A single quote terminates the JS string, executing arbitrary script.

Details

// LegacyController.php:75
$html .= "<script>\ndocument.title = '$title';\n</script>";

// proxmox.inc.php:38,42
$pagetitle[] = $instance;     // GET ?instance=
$pagetitle[] = $vars['vmid']; // GET ?vmid=

PoC

http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//

Confirmed in response:
document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';

Fix

// LegacyController.php:75
$html .= "<script>\ndocument.title = " . json_encode($title) . ";\n</script>";

Also wrap $instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php.

Prerequisite

Any authenticated session. Victim must follow a crafted link.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 26.4.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "librenms/librenms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45694"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-12T15:16:22Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n`LegacyController.php:75` writes the page title into a `document.title` JS assignment using string interpolation. `apps/proxmox.inc.php` pushes `$vars[\u0027instance\u0027]` and `$vars[\u0027vmid\u0027]` (GET params, only `strip_tags()` applied) directly into `$pagetitle`. A single quote terminates the JS string, executing arbitrary script.\n\n### Details\n```php\n// LegacyController.php:75\n$html .= \"\u003cscript\u003e\\ndocument.title = \u0027$title\u0027;\\n\u003c/script\u003e\";\n\n// proxmox.inc.php:38,42\n$pagetitle[] = $instance;     // GET ?instance=\n$pagetitle[] = $vars[\u0027vmid\u0027]; // GET ?vmid=\n```\n\n### PoC\n```\nhttp://target/apps?app=proxmox\u0026instance=%27%3Balert%28document.cookie%29%3B//\n\nConfirmed in response:\ndocument.title = \u0027Apps - Proxmox - \u0027;alert(document.cookie);// - LibreNMS\u0027;\n```\n\n### Fix\n```php\n// LegacyController.php:75\n$html .= \"\u003cscript\u003e\\ndocument.title = \" . json_encode($title) . \";\\n\u003c/script\u003e\";\n```\nAlso wrap `$instance` and `$vars[\u0027vmid\u0027]` in `htmlspecialchars()` in proxmox.inc.php.\n\n### Prerequisite\nAny authenticated session. Victim must follow a crafted link.",
  "id": "GHSA-jmqm-f8q4-v7wx",
  "modified": "2026-08-12T15:16:22Z",
  "published": "2026-08-12T15:16:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/security/advisories/GHSA-jmqm-f8q4-v7wx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/librenms/librenms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/releases/tag/26.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.