LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.

Affected: Packagist: librenms/librenms

### Summary The `unit` parameter in Custom OID functionality lacks `strip_tags()` sanitization while other fields (`name`, `oid`, `datatype`) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping, allowing Stored XSS.

### Details **Vulnerable Input Processing (`includes/html/forms/customoid.inc.php` lines 18-21):** ```php $name = strip_tags((string) $_POST['name']); // line 18 - SANITIZED $oid = strip_tags((string) $_POST['oid']); // line 19 - SANITIZED $datatype = strip_tags((string) $_POST['datatype']); // line 20 - SANITIZED $unit = $_POST['unit']; // line 21 - NOT SANITIZED! ```

**Vulnerable Output (`graphs/customoid.inc.php` lines 13-20):** ```php $customoid_unit = $customoid['customoid_unit']; // Retrieved from DB $customoid_current = \LibreNMS\Util\Number::formatSi(...) . $customoid_unit; echo "...$customoid_current..."; // ECHOED WITHOUT ESCAPING! ```

### PoC

```python #!/usr/bin/env python3 """ XSS test for LibreNMS Custom OID - unit parameter """

import html as html_module import re

def strip_tags(value): return re.sub(r'<[^>]*?>', '', str(value))

# Simulate form processing (customoid.inc.php lines 18-21) test_inputs = { 'name': '<script>alert(1)</script>Test OID', 'oid': '1.3.6.1.4.1.2021.10.1.3.1', 'datatype': 'GAUGE', 'unit': '<script>alert("XSS")</script>', }

name = strip_tags(test_inputs['name']) # Sanitized oid = strip_tags(test_inputs['oid…