CVE-2025-62365: LibreNMS is vulnerable to Reflected-XSS in `report_this` function
N/A
Basic Information
Technical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | <= 25.6.0 | 25.7.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability exists in the report_this function located in includes/functions.php. This function was responsible for generating a link to report issues. The vulnerability stems from the improper sanitization of the project_issues parameter, which is incorporated into the href attribute of a link. The patch addresses this vulnerability by completely removing the report_this function and replacing its calls with simple text messages. The core of the vulnerability is the use of htmlentities on user-controllable input that is then placed in an href attribute. An attacker could provide a value like javascript:alert(1) for the project_issues parameter, which would not be neutralized by htmlentities and would result in a clickable link that executes malicious JavaScript in the user's browser. The fix, by removing the function, eliminates this risk entirely.
Vulnerable functions
report_thisincludes/functions.php