0Xcraig

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions 23.10.0 through 26.3.x **Description** An authenticated administrator can execute arbitrary operating system commands in the discovery worker context. The issue occurs when libvirt support is enabled via the `enable libvirt=true` configuration. The software fails to properly sanitize the device hostname `hostname` before concatenating it into shell commands such as `ssh`, `virsh list`, `virsh dumpxml`, and `virsh domstate` within the `VminfoLibvirt.php` file. These commands are then passed to the `exec()` function without using `escapeshellarg()` or proper argument separation, allowing a crafted hostname to inject malicious commands. **Recommendations** Update LibreNMS to version 26.4.0 or newer. As a temporary mitigation, disable libvirt discovery by setting `enable libvirt=false` if the feature is not required.