CVE-2026-109354

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0

Description A path traversal issue exists in the nfsen channel common.inc.php file. Authenticated users can read unauthorized RRD (Round Robin Database) data by injecting ../ sequences into the channel parameter when requesting the graph.php endpoint. This allows an attacker with access to a single NFSen-enabled device to view traffic and NetFlow graphs of devices outside their authorized scope.

Recommendations Update to version 26.9.0 or later. As a temporary mitigation, restrict access to the graph.php endpoint or avoid using the channel parameter until the update is applied.