CVE-2026-2728: 
PHP vulnerability analysis and mitigation

CVE-2026-2728 is a Stored Cross-Site Scripting (XSS) vulnerability in LibreNMS's ShowConfig page, specifically within the RANCID Integration settings. The application fails to properly sanitize the rancid_repo_url configuration value, which is rendered unsanitized inside an HTML anchor (<a>) tag on device configuration pages. It affects LibreNMS versions >= 25.12.0 and < 26.3.0, with version 26.3.0 containing the fix. The vulnerability was published on April 13, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 4.6 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), classified as a Stored XSS. The vulnerability originates in includes/html/pages/device/showconfig.inc.php (line 13), where the rancid_repo_url value is neither validated upon saving nor contextually encoded upon rendering — it is inserted directly into an HTML <a> tag's href attribute. An attacker can break out of the href attribute context using payloads such as "><img/src/onerror=alert(1)><a x=" or use JavaScript URIs to attach malicious event handlers. Exploitation requires the attacker to first set a valid rancid_configs path (any directory ending in .git) to trigger the rendering of the repository URL link on the /device/{id}/showconfig UI (GitHub Advisory, Project Black Blog).

Successful exploitation allows an authenticated attacker with administrative privileges to inject persistent malicious JavaScript that executes in the browsers of any user who views the affected device's ShowConfig page. Potential consequences include session token theft, unauthorized actions performed on behalf of victim users, and redirection to malicious sites. There is no direct availability impact, but confidentiality and integrity of subsequent systems are both rated as low-impact due to the cross-site nature of the attack (GitHub Advisory, Feedly).

A public proof-of-concept (PoC) with step-by-step reproduction instructions is available on Project Black's blog, covering both the XSS and a related RCE vulnerability in LibreNMS. Exploitation requires high privileges (administrative access) and active user interaction from a victim. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.006% (very low probability of exploitation in the near term) (Project Black Blog, Feedly).

1. Authenticate as Admin: Log in to the LibreNMS instance with an account that has administrative privileges and access to external settings.
2. Navigate to RANCID Settings: Go to /settings/external/rancid in the LibreNMS web interface.
3. Set a valid rancid_configs path: Enter any directory path ending in .git in the rancid_configs field to enable the RANCID integration and trigger rendering of the repository URL.
4. Inject XSS payload: In the rancid_repo_url field, enter a malicious payload such as "><img/src/onerror=alert(1)><a x=" to break out of the href attribute context and inject arbitrary JavaScript.
5. Save the configuration: Submit the settings form, storing the malicious payload in the application's configuration.
6. Trigger victim execution: When any user (including lower-privileged users) navigates to a device's ShowConfig page (/device/{id}/showconfig), the stored payload executes in their browser, enabling session token theft, credential harvesting, or further malicious actions (Project Black Blog, GitHub Advisory).

• Logs: LibreNMS access logs showing POST requests to /settings/external/rancid containing unusual or encoded values in the rancid_repo_url parameter (e.g., <, >, onerror, javascript:, alert).
• Logs: Web server access logs showing GET requests to /device/{id}/showconfig from multiple users shortly after a suspicious configuration change.
• File System: Unexpected changes to LibreNMS configuration files or database entries for rancid_repo_url containing HTML/JavaScript special characters.
• Network: Outbound connections from victim browsers to unknown external domains following visits to device ShowConfig pages, potentially indicating session token exfiltration or redirects to attacker-controlled infrastructure.
• Application: Unusual JavaScript errors or unexpected alert dialogs appearing in the LibreNMS UI for users viewing device configuration pages (Project Black Blog).

Upgrade LibreNMS to version 26.3.0 or later, which contains the fix for this vulnerability. As interim mitigations, restrict access to the /settings/external/rancid endpoint to only highly trusted administrators, and implement a strict Content Security Policy (CSP) header to limit the impact of any stored XSS. Auditing existing rancid_repo_url configuration values for suspicious content is also recommended (GitHub Advisory, Feedly).

The vulnerability was reported by Project Black (assigner: PRJBLK), who published a detailed technical blog post covering both this XSS and a related authenticated RCE in LibreNMS. The initial GitHub Advisory (GHSA-rp7w-624x-95qv) was withdrawn on May 12, 2026, as a duplicate, with the canonical advisory consolidated under GHSA-5gm9-622f-qcg5. No significant broader media coverage or notable community debate has been identified beyond the researcher's disclosure (Project Black Blog, GitHub Advisory).