CVE-2026-45694: 
PHP vulnerability analysis and mitigation

CVE-2026-45694 is a reflected Cross-Site Scripting (XSS) vulnerability in LibreNMS affecting the Proxmox application integration. It allows authenticated attackers to inject arbitrary JavaScript via the instance or vmid GET parameters, which are unsafely interpolated into a document.title JavaScript assignment in the rendered page. All versions up to and including 26.4.0 are affected; version 26.5.0 contains the fix. The vulnerability was published on August 4, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, LibreNMS Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). In LegacyController.php (line 75), the page title is written into a <script> block using PHP string interpolation: $html .= "<script>\ndocument.title = '$title';\n</script>";. The apps/proxmox.inc.php file pushes the $vars['instance'] and $vars['vmid'] GET parameters directly into $pagetitle with only strip_tags() applied — insufficient to prevent JavaScript injection. An attacker can terminate the JS string literal with a single quote and inject arbitrary script (e.g., ?instance='%3Balert(document.cookie)%3B//), which is then reflected verbatim in the server's HTML response (GitHub Advisory, LibreNMS Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of an authenticated LibreNMS user who clicks a crafted link. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential account takeover within the LibreNMS instance. Availability is not impacted, but both confidentiality (e.g., cookie/session data exposure) and integrity (e.g., DOM manipulation, phishing overlays) are affected at a low level (GitHub Advisory).

A public proof-of-concept is included in the GitHub Security Advisory, demonstrating cookie exfiltration via a crafted URL. Exploitation requires the attacker to hold a valid (low-privilege) authenticated session and to socially engineer another authenticated user into clicking the malicious link. There is no evidence of in-the-wild exploitation, no CISA KEV listing, and no known exploit kit integration at this time. The CVE status is currently "Reserved" and no EPSS score has been published (GitHub Advisory, LibreNMS Advisory).

1. Authenticate: Obtain any valid LibreNMS user account (low-privilege access is sufficient).
2. Craft malicious URL: Construct a URL targeting the Proxmox app page with a payload in the instance or vmid GET parameter that breaks out of the JS string literal, e.g.:

   http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//

3. Deliver the link: Send the crafted URL to a target authenticated LibreNMS user via phishing email, chat message, or other social engineering vector.
4. Victim clicks the link: The victim's browser loads the page; the server reflects the unsanitized instance value into the document.title JS assignment, resulting in:

   document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';

5. Arbitrary script executes: The injected script runs in the victim's browser session, enabling cookie theft, session hijacking, or further malicious actions within the LibreNMS application context (GitHub Advisory, LibreNMS Advisory).

• Network: HTTP GET requests to /apps?app=proxmox containing URL-encoded single quotes (%27), semicolons (%3B), or JavaScript keywords (alert, document.cookie, fetch, XMLHttpRequest) in the instance or vmid parameters.
• Logs: Web server access logs showing requests to the Proxmox app endpoint with anomalous or encoded characters in GET parameters; repeated requests from the same source IP with varying payloads (indicating probing).
• Logs: Application logs reflecting unusual page title values containing JavaScript syntax fragments.
• Network: Outbound requests from victim browsers to attacker-controlled domains shortly after accessing the crafted URL (indicative of cookie/data exfiltration via injected script).

Upgrade LibreNMS to version 26.5.0 or later, which resolves this vulnerability by replacing string interpolation in LegacyController.php with json_encode($title) for safe JS output, and wrapping $instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php. If immediate upgrade is not possible, restrict access to the LibreNMS web interface to trusted networks and educate users not to click unsolicited links to the application. No configuration-only workaround fully mitigates the vulnerability without code changes (LibreNMS Release, GitHub Advisory).

The vulnerability was reported by security researcher k1bana and patched by LibreNMS maintainer murrant as part of a broader set of XSS fixes included in the 26.5.0 release (which also addressed XSS in netmap, edituser, and legacy page titles). No significant public media coverage or notable social media discussion has been identified beyond the GitHub advisory (LibreNMS Release, LibreNMS Advisory).