CVE-2026-109354

4.3Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-22

Impact

Authenticated users can view traffic and NetFlow graphs for devices outside their authorized scope. They need valid credentials to an account with access to at least one NFSen-enabled device.

Root cause

The channel parameter in nfsen_channel_common.inc.php does not sanitize path traversal sequences, allowing users to load arbitrary RRD files via graph.php.

Affected systems

LibreNMS versions prior to 26.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade LibreNMS to version 26.9.0 or later. If updating immediately is not possible, restrict user access to NFSen features or limit network access to the web interface to trusted administrators.

shell

$ ./daily.sh

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traversed channel value to view traffic and NetFlow graphs of devices outside their authorized scope.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109354