Git · Librenms · CVE-2026-45694
**Name of the Vulnerable Software and Affected Versions**
LibreNMS versions prior to 26.5.0
**Description**
The Proxmox application view contains a reflected cross-site scripting issue. The application fails to adequately encode the `instance` and `vmid` GET parameters before reflecting them into the page title. Specifically, the `LegacyController.php` file writes the page title into a `document.title` JavaScript assignment using string interpolation. Because only the `strip tags()` function is applied to these parameters, an attacker can use a single quote to terminate the JavaScript string and execute arbitrary scripts in the session of an authenticated user who follows a crafted link. This could lead to the theft of session data.
**Recommendations**
Update to version 26.5.0.
As a temporary mitigation, restrict access to the Proxmox application view or avoid using the `instance` and `vmid` parameters in the affected GET requests.