CVE-2025-55296
Medium
Description
librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template is rendered, potentially compromising other admin accounts. This vulnerability is fixed in 25.8.0.
SeverityMedium
CVSS5.5
Exploit probability—
ProductLibrenms
PublishedAug 18, 2025
First seenAug 18, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- librenms librenms25.8.0 or later
- librenms/librenms25.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| librenms librenms | v < 25.8.0 | 25.8.0 |
| librenms/librenmsPackagist | v < 25.8.0 | 25.8.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.