CVE-2026-45694

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.5.0

Description The Proxmox application view contains a reflected cross-site scripting issue. The application fails to adequately encode the instance and vmid GET parameters before reflecting them into the page title. Specifically, the LegacyController.php file writes the page title into a document.title JavaScript assignment using string interpolation. Because only the strip tags() function is applied to these parameters, an attacker can use a single quote to terminate the JavaScript string and execute arbitrary scripts in the session of an authenticated user who follows a crafted link. This could lead to the theft of session data.

Recommendations Update to version 26.5.0. As a temporary mitigation, restrict access to the Proxmox application view or avoid using the instance and vmid parameters in the affected GET requests.