Miggo Logo

CVE-2025-62365: LibreNMS is vulnerable to Reflected-XSS in `report_this` function

N/A

CVSS Score

Basic Information

EPSS Score
-
Published
10/13/2025
Updated
10/14/2025
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
librenms/librenmscomposer<= 25.6.025.7.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability exists in the report_this function located in includes/functions.php. This function was responsible for generating a link to report issues. The vulnerability stems from the improper sanitization of the project_issues parameter, which is incorporated into the href attribute of a link. The patch addresses this vulnerability by completely removing the report_this function and replacing its calls with simple text messages. The core of the vulnerability is the use of htmlentities on user-controllable input that is then placed in an href attribute. An attacker could provide a value like javascript:alert(1) for the project_issues parameter, which would not be neutralized by htmlentities and would result in a clickable link that executes malicious JavaScript in the user's browser. The fix, by removing the function, eliminates this risk entirely.

Vulnerable functions

report_this
includes/functions.php
The `report_this` function is vulnerable to reflected Cross-Site Scripting (XSS). The `project_issues` parameter, retrieved via `Config::get('project_issues')`, is encoded with `htmlentities` and then embedded into an `<a>` tag's `href` attribute. The `htmlentities` function does not properly sanitize URI schemes, allowing an attacker to inject a `javascript:` payload, which will be executed when a user clicks the generated link.

WAF Protection Rules

WAF Rule

### Summ*ry R**l**t**-XSS in `r*port_t*is` *un*tion in `li*r*nms/in*lu**s/*un*tions.p*p` ### **t*ils R***ntly, it w*s *is*ov*r** t**t t** `r*port_t*is` *un*tion *** improp*r *ilt*rin* (`*tml*ntiti*s` *un*tion w*s in*orr**tly us** in * *r** *nvironm

Reasoning

T** vuln*r**ility *xists in t** `r*port_t*is` *un*tion lo**t** in `in*lu**s/*un*tions.p*p`. T*is *un*tion w*s r*sponsi*l* *or **n*r*tin* * link to r*port issu*s. T** vuln*r**ility st*ms *rom t** improp*r s*nitiz*tion o* t** `proj**t_issu*s` p*r*m*t*r