PT-2026-80267 · Packagist · Librenms/Librenms

Published

2026-08-18

·

Updated

2026-08-18

CVSS v4.0

8.6

High

VectorAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.

Details

The vulnerability is caused by an unsafe exec call in deliverAlert function of LibreNMS/Alert/Transport/Signal.php. Escapes for the path of signal-cli and the Recipient field are insufficient to prevent command-line injection.
The composer wrapper.php under scripts is also vulnerable to command injection (unsafe exec calls) by passing the injected command as an argument, and it is accepting arguments passed by deliverAlert.
By chaining these unsafe exec calls, malicious admin user can execute any executables in the server's filesystem.

PoC

  1. Under Dashboard -> Alert -> Alert Transports
image
  1. Create a new Alert Transport entry. a. Select Signal as Transport type. b. Put ../scripts/composer wrapper.php into Path. c. Put the command to execute under Recipient with ; at the start and the end of string.
image
  1. . Click Save Transport, and after the popup closed, click Test Transport button under Action of the created Alert Transport entry.
image
  1. The command is executed. image

Impact

This vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Remediation Advice

Escape user inputs, and avoid passing them directly into exec function. (scripts/composer wrapper.php) Avoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (LibreNMS/Alert/Transport/Signal.php)

Fix

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-77

Related Identifiers

GHSA-C9FV-CGMM-2WG7

Affected Products

Librenms/Librenms