LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
Date: 2026-03
Affected: composer/librenms/librenms
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-6204
CWE: CWE-78

### Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By modifying the binary path settings for built-in network tools and bypassing an input filter, an attacker with administrative privileges can download and execute malicious payloads. ### Details The application allows administrative users to configure the absolute binary paths for network diagnostic tools at `/settings/external/binaries`. This setting does not sufficiently validate ensuring the paths remain restricted to safe, intended executables. These tools are invoked by sending a request to the `GET /ajax/netcmd` endpoint. While there is an existing input filter designed to restrict arguments to valid IP addresses or hostnames, this filter can be bypassed. ### PoC To reproduce this vulnerability, a remote HTTP server should be hosted with a malicious script/executable, ensure the remote server is reachable by the server running LibreNMS. The PoC will use the file `malicious.sh` containing the following content. It will return the content of /etc/passwd and /etc/group, current working directory, username that is running the script, and it will list files of the current directory. ```bash #!/usr/bin/env bash cat /etc/passwd cat /etc/group whoami pwd ls ``` 1. Host a remote HTTP server that the server can reach and place the malicious script on the remote server. For demonstration, I will start it on localhost. <img width="593" heigh


Mitigations:

Architectural layers (MAESTRO):