LibreNMS XSS flaw patched
A cross-site scripting vulnerability in LibreNMS allows remote code injection; vendor patch available.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The French national cybersecurity agency ANSSI has issued an advisory for a cross-site scripting (XSS) vulnerability discovered in LibreNMS, an open-source network monitoring system. The flaw enables an attacker to perform remote indirect code injection via XSS.
The vulnerability affects LibreNMS installations without the latest security patches. Users are advised to apply the vendor-supplied security update immediately to remediate the issue. The LibreNMS project published a security advisory (GHSA-7w8c-qgxg-m7jx) on 15 June 2026 addressing this vulnerability.
Organizations running LibreNMS should prioritize patching, particularly those with externally-facing instances or untrusted users with access to the interface. XSS vulnerabilities in monitoring platforms can be leveraged for credential theft, session hijacking, or further network reconnaissance.
Detection guidance
Command Interpreter Spawned by Web Server / PHP Process (Possible LibreNMS Web Exploitation)
A behavioural hunt for the technique in general.
Detects a shell or scripting interpreter being spawned as a child of a web server or PHP-FPM process, consistent with post-exploitation command execution following successful XSS/injection abuse of a web application such as LibreNMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Interpreter Spawned by Web Server or PHP Process
id: 6e34c94c-5ae0-59fb-83ec-ccf734b409a8
status: experimental
description: Detects a shell or scripting interpreter (sh, bash, python, perl) being
spawned as a child of a web server or PHP-FPM process. This is a common post-exploitation
pattern after successful exploitation of a web application vulnerability (e.g. XSS
leading to remote code injection) such as the LibreNMS advisory GHSA-7w8c-qgxg-m7jx.
references:
- https://github.com/librenms/librenms/security/advisories/GHSA-7w8c-qgxg-m7jx
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /php-fpm
- /apache2
- /httpd
- /nginx
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
filter:
CommandLine|contains:
- librenms/poller.php
- librenms/discovery.php
- rrdtool
- snmp
condition: selection and not filter
falsepositives:
- LibreNMS legitimate polling and discovery scripts that shell out to snmp/rrdtool
utilities
- Custom monitoring plugins or cron jobs invoked through the web server user
level: medium
tags:
- attack.t1059
- attack.execution
author: Vorant
Suspicious Base64/Encoded Command Execution via Web-Facing Service Account
A behavioural hunt for the technique in general.
Detects encoded or piped command execution (e.g. base64 decode into shell) run under a web-server service account, a common technique used to execute injected payloads after exploiting a web application vulnerability like the LibreNMS XSS flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Encoded Command Execution Under Web Service Account
id: eb8717b9-7641-5bb1-a90e-870f276de4d0
status: experimental
description: Detects command lines containing base64-encoded payloads piped to a shell
interpreter, executed under a web server or PHP service account. This pattern is
frequently observed when an attacker uses an injected script (e.g. via XSS-driven
code injection) to deliver and execute a secondary payload on a compromised web
application host such as LibreNMS.
references:
- https://github.com/librenms/librenms/security/advisories/GHSA-7w8c-qgxg-m7jx
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains:
- base64 -d
- base64 --decode
- '| bash'
- '| sh'
user_context:
User|contains:
- www-data
- apache
- nginx
- librenms
condition: selection and user_context
falsepositives:
- Legitimate deployment scripts run by administrators under the web service account
- Encoded configuration payloads used by internal automation tooling
level: medium
tags:
- attack.t1059
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0755
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs