CVE-2026-6204 LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
Authenticated administrators can achieve remote code execution on the web server by abusing Binary Locations config and Netcommand features.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6204?
CVE-2026-6204 is a high-severity command injection vulnerability in Librenms Librenms, published on 13 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.
Weakness: CWE-78
Which versions are affected by CVE-2026-6204?
2 open source packages ship an affected version, including librenms/librenms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
librenms/librenms Packagist | From 1.48 | 26.3.0 |
librenms/librenms Packagist | From 1.48 | 26.3.0 |
Products include Librenms Librenms.
How do I fix CVE-2026-6204?
Upgrade librenms/librenms to 26.3.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-6204 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6204 exists.
Other vulnerabilities in Librenms Librenms
Sources
Also known as GHSA-pr3g-phhr-h8fh.