CVEs / CVE-2025-55296
CVE-2025-55296: librenms librenms vulnerability
- medium 5.4 CVSS 3.1 (NVD)
- EPSS 17% chance of exploitation in the next 30 days, higher than 97% of CVEs (1 Nov 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2025-55296
Description
librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template is rendered, potentially compromising other admin accounts. This vulnerability is fixed in 25.8.0.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| librenms librenms | < 25.8.0 | — |
| Product | Affected | Fixed in |
|---|---|---|
| librenms/librenms (Packagist) | before 25.8.0 | 25.8.0 |
Package versions from GHSA-vxq6-8cwm-wj99.
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 30 Oct 2026.
Severity
| CVSS 3.1 | 5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NScored by NVD |
|---|---|
| Weakness | CWE-79 |
References
- CVE-2025-55296 on NVD
- CVE-2025-55296 on OSV
- https://github.com/librenms/librenms/commit/8ade3d827d317f5ac4b336617aafff865f825958 Patch
- https://github.com/librenms/librenms/security/advisories/GHSA-vxq6-8cwm-wj99 Exploit, Vendor Advisory
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.