LibreNMS XSS flaw patched
A cross-site scripting vulnerability in LibreNMS allows remote code injection; vendor patch available.
The French national cybersecurity agency ANSSI has issued an advisory for a cross-site scripting (XSS) vulnerability discovered in LibreNMS, an open-source network monitoring system. The flaw enables an attacker to perform remote indirect code injection via XSS.
The vulnerability affects LibreNMS installations without the latest security patches. Users are advised to apply the vendor-supplied security update immediately to remediate the issue. The LibreNMS project published a security advisory (GHSA-7w8c-qgxg-m7jx) on 15 June 2026 addressing this vulnerability.
Organizations running LibreNMS should prioritize patching, particularly those with externally-facing instances or untrusted users with access to the interface. XSS vulnerabilities in monitoring platforms can be leveraged for credential theft, session hijacking, or further network reconnaissance.
Detection guidance
Command Interpreter Spawned by Web Server / PHP Process (Possible LibreNMS Web Exploitation)
Detects a shell or scripting interpreter being spawned as a child of a web server or PHP-FPM process, consistent with post-exploitation command execution following successful XSS/injection abuse of a web application such as LibreNMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Interpreter Spawned by Web Server or PHP Process
id: 6e34c94c-5ae0-59fb-83ec-ccf734b409a8
status: experimental
description: Detects a shell or scripting interpreter (sh, bash, python, perl) being
spawned as a child of a web server or PHP-FPM process. This is a common post-exploitation
pattern after successful exploitation of a web application vulnerability (e.g. XSS
leading to remote code injection) such as the LibreNMS advisory GHSA-7w8c-qgxg-m7jx.
references:
- https://github.com/librenms/librenms/security/advisories/GHSA-7w8c-qgxg-m7jx
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /php-fpm
- /apache2
- /httpd
- /nginx
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
filter:
CommandLine|contains:
- librenms/poller.php
- librenms/discovery.php
- rrdtool
- snmp
condition: selection and not filter
falsepositives:
- LibreNMS legitimate polling and discovery scripts that shell out to snmp/rrdtool
utilities
- Custom monitoring plugins or cron jobs invoked through the web server user
level: medium
tags:
- attack.t1059
- attack.execution
author: Vorant
Suspicious Base64/Encoded Command Execution via Web-Facing Service Account
Detects encoded or piped command execution (e.g. base64 decode into shell) run under a web-server service account, a common technique used to execute injected payloads after exploiting a web application vulnerability like the LibreNMS XSS flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Encoded Command Execution Under Web Service Account
id: eb8717b9-7641-5bb1-a90e-870f276de4d0
status: experimental
description: Detects command lines containing base64-encoded payloads piped to a shell
interpreter, executed under a web server or PHP service account. This pattern is
frequently observed when an attacker uses an injected script (e.g. via XSS-driven
code injection) to deliver and execute a secondary payload on a compromised web
application host such as LibreNMS.
references:
- https://github.com/librenms/librenms/security/advisories/GHSA-7w8c-qgxg-m7jx
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains:
- base64 -d
- base64 --decode
- '| bash'
- '| sh'
user_context:
User|contains:
- www-data
- apache
- nginx
- librenms
condition: selection and user_context
falsepositives:
- Legitimate deployment scripts run by administrators under the web service account
- Encoded configuration payloads used by internal automation tooling
level: medium
tags:
- attack.t1059
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0755
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free