CVE-2025-68614 LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

What is CVE-2025-68614?

CVE-2025-68614 is a medium-severity cross-site scripting vulnerability in Librenms Librenms, published on 22 Dec 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site scripting. Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject HTML code. This issue has been patched in version 25.12.0.

Weakness: CWE-79

Which versions are affected by CVE-2025-68614?

2 open source packages ship an affected version, including librenms/librenms. It affects 1 product.

Products include Librenms Librenms.

How do I fix CVE-2025-68614?

Upgrade librenms/librenms to 25.12.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-68614 being exploited?

There is no known exploitation of CVE-2025-68614 in the wild and no public exploit code.

Other vulnerabilities in Librenms Librenms

• CVE-2023-4982 Cross-site Scripting (XSS) - Stored in librenms/librenms Critical 9.8
• CVE-2022-29712 Command injection in librenms Critical 9.8
• CVE-2021-44278 Path traversal in librenms/librenms Critical 9.8
• CVE-2019-10665 LibreNMS Information Disclosure Critical 9.8
• CVE-2018-20434 LibreNMS arbitrary OS commands execution Critical 9.8

All Librenms Librenms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c89f-8g7g-59wj.