CVE-2025-55296: 
PHP vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-55296) was discovered in LibreNMS versions 25.6.0 and earlier. The vulnerability exists in the Alert Template creation feature, specifically in the Template name field. This security flaw was discovered and reported by at4111, and was patched in version 25.8.0 (GitHub Advisory).

The vulnerability stems from improper sanitization of user input in the Alert Template name field. When creating a new alert template via the /templates endpoint, the application fails to properly sanitize and encode the Template name field input before storing and rendering it. This allows for injection of malicious JavaScript code that gets executed when the template is rendered. The vulnerability has been assigned a CVSS v3.1 score of 5.5 (Moderate) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N (GitHub Advisory).

The vulnerability can be exploited to perform session hijacking, data theft, or other malicious actions targeting admin users. The impact is limited to accounts with admin role privileges who access the Alert Templates page. When exploited, the vulnerability allows attackers to execute arbitrary JavaScript code in the context of other administrators' browsers (GitHub Advisory).

The vulnerability has been fixed in LibreNMS version 25.8.0 by implementing proper output encoding for the template name field. The fix includes using htmlspecialchars() function to properly encode the template name before display (GitHub Commit). Users should upgrade to version 25.8.0 or later to mitigate this vulnerability.