CVE-2025-23199 Stored XSS-LibreNMS-Ports in librenms

What is CVE-2025-23199?

CVE-2025-23199 is a medium-severity cross-site scripting vulnerability in Librenms Librenms, published on 16 Jan 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `/ajax_form.php` -> param: descr. Librenms version up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2025-23199?

2 open source packages ship an affected version, including librenms/librenms. It affects 1 product.

Products include Librenms Librenms.

How do I fix CVE-2025-23199?

Upgrade librenms/librenms to 24.11.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-23199 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-23199 exists.

Other vulnerabilities in Librenms Librenms

• CVE-2023-4982 Cross-site Scripting (XSS) - Stored in librenms/librenms Critical 9.8
• CVE-2022-29712 Command injection in librenms Critical 9.8
• CVE-2021-44278 Path traversal in librenms/librenms Critical 9.8
• CVE-2019-10665 LibreNMS Information Disclosure Critical 9.8
• CVE-2018-20434 LibreNMS arbitrary OS commands execution Critical 9.8

All Librenms Librenms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-27vf-3g4f-6jp7.