CVE-2026-109354 librenms CVE debrief

Who should care

System administrators and security teams responsible for LibreNMS installations, particularly those with exposed systems or networks, should verify current system versions, restrict access to NFSen-enabled devices, and monitor for suspicious activity. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

The path traversal vulnerability in LibreNMS before 26.9.0 allows authenticated users to access unauthorized RRD data, potentially disrupting network monitoring and traffic analysis. System administrators and security teams should verify current system versions, restrict access to NFSen-enabled devices, and monitor for suspicious activity.

• Potential unauthorized access to RRD data
• Possible disruption of network monitoring and traffic analysis
• Need for verification of current system versions and exposure
• Potential for lateral movement within networks

Technical summary

The path traversal vulnerability in nfsen_channel_common.inc.php allows authenticated users to inject ../ sequences into the channel parameter, potentially leading to unauthorized access to RRD data. The vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. The CVE record and source item provide details on the vulnerability, including its impact and potential mitigations. System administrators and security teams should verify current system versions, restrict access to NFSen-enabled devices, and monitor for suspicious activity.

Defensive priority

Medium-priority patching required for exposed systems

Recommended defensive actions

• Patch or upgrade LibreNMS to version 26.9.0 or later
• Restrict access to NFSen-enabled devices to authorized users
• Monitor for suspicious activity on graph.php requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the path traversal vulnerability in LibreNMS before 26.9.0. The vulnerability is caused by a lack of proper input validation in the nfsen_channel_common.inc.php file, which allows attackers to inject ../ sequences into the channel parameter. The CVE record was published on 2026-10-12T16:05:35.816Z and has not been modified since then. There are no known exploits or attacks in the wild, but system administrators and security teams should verify current system versions, restrict access,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.