CVE-2026-55182
published 2026-08-26CVE-2026-55182: LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the…
PriorityP260high8.6CVSS 4.0
AVNACLATNPRHUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
1.61%
75.0th percentile
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| librenms | librenms | — | — |
| librenms | librenms | >= 21.6.0 < 26.5.0 | 26.5.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
LibreNMS up to 26.4.x Signal composer_wrapper.php Recipient os command injection
vuldb·2026-08-27·CVSS 8.6
CVE-2026-55182 [HIGH] LibreNMS up to 26.4.x Signal composer_wrapper.php Recipient os command injection
A vulnerability, which was classified as problematic, has been found in LibreNMS up to 26.4.x. Impacted is an unknown function of the file composer_wrapper.php of the component Signal. The manipulation of the argument Recipient leads to os command injection.
This vulnerability is referenced as CVE-2026-55182. Remote exploitation of the attack is possible. No exploit is available.
It is advisable to upgrade the affected component.
GHSA
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
ghsa·2026-08-18
CVE-2026-55182 [HIGH] CWE-77 LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
### Summary
A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.
### Details
The vulnerability is caused by an unsafe `exec` call in `deliverAlert` function of `LibreNMS/Alert/Transport/Signal.php`. Escapes for the path of `signal-cli` and the `Recipient` field are insufficient to prevent command-line injection.
The `composer_wrapper.php` under `scripts` is also vulnerable to command injection (unsafe `exec` calls) by passing the injected command as an argument, and it is accepting arguments passed by `deliverAlert`.
By chai
No detection rules found.
No public exploits indexed.
2026-08-26
Published