CVE-2026-84190

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.5.0

Description An authenticated administrator can achieve remote code execution via the AboutController. The issue occurs because the snmpget configuration parameter is passed to the shell exec() function without proper validation. An attacker can modify the snmpget configuration to point to a malicious executable and trigger its execution by accessing the '/about' endpoint.

Recommendations Update to version 26.5.0 or later. Restrict access to the '/about' endpoint to minimize the risk of exploitation.