CVE-2026-84189

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.7.0

Description The software fails to apply htmlspecialchars() when rendering JSON fields returned by the admin-configurable Oxidized integration URL (oxidized.url) on the device showconfig page. If an administrator points this URL to an attacker-controlled server, it can lead to Server-Side Request Forgery (SSRF) and the return of malicious JSON. This results in stored cross-site scripting (XSS), which affects all users who view the showconfig tab of any device.

Recommendations Update to version 26.7.0 or later.