CVE-2026-26989: 
PHP vulnerability analysis and mitigation

CVE-2026-26989 is a Stored Cross-Site Scripting (XSS) vulnerability in LibreNMS's Alert Rules workflow, classified as Moderate severity. It affects LibreNMS versions 25.12.0 and below, allowing an authenticated administrator to inject malicious JavaScript that executes in the browser of any user who views the Alert Rules page. The vulnerability was published on February 17, 2026, and patched in version 26.2.0 released February 16, 2026. It carries a CVSS v3.1 base score of 4.8 (Moderate) per Feedly threat intelligence data, or 4.3 (Moderate) per the GitHub Advisory (GitHub Advisory, LibreNMS Advisory).

The root cause is improper neutralization of user-controlled input before it is rendered in a web page (CWE-79). Specifically, the $rule_display variable in includes/html/modal/alert_rule_list.inc.php (line 63) was output using only the e() escape function, which proved insufficient because the bootgrid JavaScript library re-interprets the escaped content as HTML, allowing injected tags to execute. An attacker with admin-level access crafts a POST request to /alert-rule embedding a malicious JavaScript payload (e.g., <script>alert("xss")</script>) within the builder_json or builder_rule_0_value_0 parameters of an alert rule definition. The fix applied strip_tags() in addition to e() on the $rule_display value to prevent HTML tag injection (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated administrator to persistently inject malicious scripts that execute in the browsers of all users who visit the Alert Rules page, including other administrators and read-only users. This can lead to session hijacking, credential theft, or other client-side attacks such as unauthorized actions performed on behalf of the victim. The impact is limited to confidentiality and integrity of individual user sessions rather than the underlying server or database (GitHub Advisory, LibreNMS Advisory).

A proof-of-concept (PoC) request is publicly documented in the GitHub Security Advisory, demonstrating the exact HTTP POST payload required to trigger the vulnerability. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.002% (0.000020), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (LibreNMS Advisory, GitHub Advisory).

1. Authenticate as Admin: Obtain valid administrator credentials for a LibreNMS instance running version 25.12.0 or earlier and log in to establish a valid session with CSRF token and session cookies.
2. Craft Malicious Alert Rule: Prepare a POST request to /alert-rule with the builder_json parameter containing a malicious JavaScript payload embedded in the rule value field, e.g., "value":"<script>alert(\"xss\")</script>", and set builder_rule_0_value_0 to <script>alert("xss")</script>.
3. Submit the Request: Send the crafted POST request with valid X-CSRF-TOKEN, session cookies, and required form fields (device_id, name, severity, etc.) to create and persist the malicious alert rule in the database.
4. Trigger Execution: Wait for any user (including non-admin users) to navigate to the Alert Rules page. The stored payload is rendered via e($rule_display) in includes/html/modal/alert_rule_list.inc.php, and the bootgrid library interprets the escaped content as HTML, executing the injected script in the victim's browser.
5. Achieve Objective: Use the executed script to steal session cookies, perform actions on behalf of the victim, or redirect users to attacker-controlled infrastructure (LibreNMS Advisory, GitHub Advisory).

• Network: Unusual POST requests to /alert-rule containing URL-encoded HTML tags (e.g., %3Cscript%3E, %3C%2Fscript%3E) in the builder_json or builder_rule_0_value_0 parameters.
• Logs: Web server access logs showing POST requests to /alert-rule with abnormally large or encoded payloads from an admin account; Laravel application logs recording alert rule creation with suspicious rule values.
• File System / Database: Alert rule entries in the LibreNMS database (alert_rules table) containing HTML or JavaScript tags in the rule or display fields.
• Browser/Client: Unexpected JavaScript execution or pop-ups when users navigate to the Alert Rules page; outbound requests from user browsers to unknown external domains originating from the LibreNMS Alert Rules page.

Upgrade LibreNMS to version 26.2.0 or later, which applies strip_tags() in addition to the existing e() escape function on the $rule_display variable in includes/html/modal/alert_rule_list.inc.php (Patch Commit, Release 26.2.0). As an interim measure, restrict administrative access to trusted personnel only and review existing Alert Rules configurations for any suspicious or unauthorized JavaScript content. Audit application logs for unexpected alert rule creation activity prior to patching (LibreNMS Advisory).

The vulnerability was reported by researcher quirmz and patched by LibreNMS maintainer murrant on February 16, 2026, the day before the advisory was published — indicating a rapid response from the project (LibreNMS Advisory, PR #19039). The fix was bundled alongside several other XSS fixes in the 26.2.0 release, suggesting a broader security review was conducted at the same time (Release 26.2.0). No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation.