Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Check if your repositories are affected!View on GitHub

GHSA-c9fv-cgmm-2wg7

HighCVSS 8.6 / 10

Published Aug 18, 2026·Last modified Aug 18, 2026

Affected Components(1)

librenms/librenms

21.6.0 – 26.5.0

Description

Summary

A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.

Details

The vulnerability is caused by an unsafe exec call in deliverAlert function of LibreNMS/Alert/Transport/Signal.php. Escapes for the path of signal-cli and the Recipient field are insufficient to prevent command-line injection.

The composer_wrapper.php under scripts is also vulnerable to command injection (unsafe exec calls) by passing the injected command as an argument, and it is accepting arguments passed by deliverAlert.

By chaining these unsafe exec calls, malicious admin user can execute any executables in the server's filesystem.

PoC

Under Dashboard -> Alert -> Alert Transports

Create a new Alert Transport entry. a. Select Signal as Transport type. b. Put ../scripts/composer_wrapper.php into Path. c. Put the command to execute under Recipient with ; at the start and the end of string.

. Click Save Transport, and after the popup closed, click Test Transport button under Action of the created Alert Transport entry.

The command is executed. <img width="532" height="216" alt="image" src="https://github.com/user-attachments/assets/d595b0fe-10cc-4050-b4b9-d290b658689d" />

Impact

This vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Remediation Advice

Escape user inputs, and avoid passing them directly into exec function. (scripts/composer_wrapper.php) Avoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (LibreNMS/Alert/Transport/Signal.php)

Upload your SBOM

Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.

Drag and drop some file here, or click to select

Risk Scores

Base Score

8.6

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs high-level or administrative privileges. No user interaction is needed for the attacker to exploit this vulnerability.

Threat Intelligence

6.1

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS

1.61%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit

Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities

Browse More

High severity

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard