CVE-2019-12464

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.50.1

Description An issue was discovered that allows an authenticated user to perform a directory traversal attack against the "pdf.php" file. This is achieved by providing a partial filename in the report parameter, leading to local file inclusion and potentially resulting in code execution.

Recommendations For LibreNMS version 1.50.1, consider restricting access to the "pdf.php" file until a patch is available. As a temporary workaround, avoid using the report parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.