PT-2026-75981 · Packagist · Librenms/Librenms
Published
2026-08-12
·
Updated
2026-08-12
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Summary
LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars['instance'] and $vars['vmid'] (GET params, only strip tags() applied) directly into $pagetitle. A single quote terminates the JS string, executing arbitrary script.Details
php
// LegacyController.php:75
$html .= "<script>
document.title = '$title';
</script>";
// proxmox.inc.php:38,42
$pagetitle[] = $instance; // GET ?instance=
$pagetitle[] = $vars['vmid']; // GET ?vmid=PoC
http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//
Confirmed in response:
document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';Fix
php
// LegacyController.php:75
$html .= "<script>
document.title = " . json encode($title) . ";
</script>";Also wrap
$instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php.Prerequisite
Any authenticated session. Victim must follow a crafted link.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Librenms/Librenms