https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:28:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290544 EUVD-2026-290544 https://cve.radiocsirt.org/vuln/euvd-2026-290544 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6204 <p>LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.</p> <p>LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6204 https://cve.radiocsirt.org/vuln/ghsa-pr3g-phhr-h8fh <p><strong>Affected:</strong> Packagist: librenms/librenms</p> <p>### Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By modifying the binary path settings for built-in network tools and bypassing an input filter, an attacker with administrative privileges can download and execute malicious payloads.</p> <p>### Details The application allows administrative users to configure the absolute binary paths for network diagnostic tools at `/settings/external/binaries`. This setting does not sufficiently validate ensuring the paths remain restricted to safe, intended executables. These tools are invoked by sending a request to the `GET /ajax/netcmd` endpoint. While there is an existing input filter designed to restrict arguments to valid IP addresses or hostnames, this filter can be bypassed.</p> <p>### PoC To reproduce this vulnerability, a remote HTTP server should be hosted with a malicious script/executable, ensure the remote server is reachable by the server running LibreNMS. The PoC will use the file `malicious.sh` containing the following content. It will return the content of /etc/passwd and /etc/group, current working directory, username that is running the script, and it will list files of the current directory.</p> <p>```bash #!/usr/bin/env bash</p> <p>cat /etc/passwd cat /etc/group whoami pwd ls ```</p> <p>1. Host a remote HTTP server that the server can reach and place the malicious script on the remote server. For demonstration, I will start it on localhost. &lt;img width=&#34;593&#34; heig…</p> <p><strong>Affected:</strong> Packagist: librenms/librenms</p> <p>### Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By modifying the binary path settings for built-in network tools and bypassing an input filter, an attacker with administrative privileges can download and execute malicious payloads.</p> <p>### Details The application allows administrative users to configure the absolute binary paths for network diagnostic tools at `/settings/external/binaries`. This setting does not sufficiently validate ensuring the paths remain restricted to safe, intended executables. These tools are invoked by sending a request to the `GET /ajax/netcmd` endpoint. While there is an existing input filter designed to restrict arguments to valid IP addresses or hostnames, this filter can be bypassed.</p> <p>### PoC To reproduce this vulnerability, a remote HTTP server should be hosted with a malicious script/executable, ensure the remote server is reachable by the server running LibreNMS. The PoC will use the file `malicious.sh` containing the following content. It will return the content of /etc/passwd and /etc/group, current working directory, username that is running the script, and it will list files of the current directory.</p> <p>```bash #!/usr/bin/env bash</p> <p>cat /etc/passwd cat /etc/group whoami pwd ls ```</p> <p>1. Host a remote HTTP server that the server can reach and place the malicious script on the remote server. For demonstration, I will start it on localhost. &lt;img width=&#34;593&#34; heig…</p> https://cve.radiocsirt.org/vuln/ghsa-pr3g-phhr-h8fh