---
id: 3719
title: "LibreNMS < 26.3.0 Authenticated RCE & XSS"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/librenms-authenticated-rce-and-xss/"
published_at: "2026-04-13 10:24"
tags: ["rce", "web-security", "xss", "librenms", "authenticated"]
phying_url: "https://phying.com/item/3719"
lang: en
---

# LibreNMS < 26.3.0 Authenticated RCE & XSS

## Summary

Searching for unsafe patterns revealed authenticated XSS and RCE in LibreNMS before 26.3.0, including an arbitrary file write path and abuse of configurable binary locations to run code.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2026-04-13 10:24
- **Original:** https://projectblack.io/blog/librenms-authenticated-rce-and-xss/
- **Phying News:** https://phying.com/item/3719