CVE-2026-109354 in LibreNMS
Summary
by MITRE • 10/12/2026
LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traversed channel value to view traffic and NetFlow graphs of devices outside their authorized scope.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in LibreNMS versions prior to 26.9.0 represents a critical path traversal flaw located within the nfsen_channel_common.inc.php module, which is integral to the Network Flow Analysis (nfsen) integration features of the platform. This security defect allows authenticated users who have been granted access to at least one device configured for NFSen monitoring to exploit improper input validation mechanisms when interacting with graph generation endpoints. Specifically, the vulnerability arises from the insufficient sanitization of the channel parameter passed during requests to graph.php. By injecting directory traversal sequences such as ../ into this parameter, an attacker can manipulate file system paths that are subsequently used to locate and retrieve Round Robin Database (RRD) files containing historical network traffic data.
From a technical perspective, the core issue lies in the application's failure to strictly validate or canonicalize user-supplied input before using it to construct file paths for reading RRD archives. These archives store time-series data regarding network interface utilization, packet counts, and other metrics essential for performance monitoring and capacity planning. When an attacker provides a maliciously crafted channel value containing relative path traversal characters, the underlying script resolves these sequences against expected directory structures, effectively breaking out of the intended sandboxed scope associated with the authorized device. This allows the retrieval of RRD files belonging to devices that reside in different organizational units or network segments where the attacking user does not possess explicit viewing permissions.
The operational impact of this vulnerability is significant as it leads to a direct compromise of data confidentiality within the monitoring infrastructure. Network administrators and security analysts rely on LibreNMS for accurate visibility into their environments, often treating the displayed traffic graphs as sensitive intelligence regarding bandwidth usage patterns, peak times, and potential anomalies indicative of malicious activity. By exploiting this path traversal flaw, an attacker can bypass access control lists and view NetFlow data from unauthorized devices. This exposure reveals detailed insights into internal network topology, communication frequencies between hosts, and potentially sensitive application behaviors that should remain restricted to higher-privileged personnel or specific security teams.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the software fails to restrict file access operations to an intended directory hierarchy. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to T1083: File and Directory Discovery, where adversaries probe for accessible files and directories to gather information about the target environment. The exploitation does not require remote code execution or privilege escalation beyond existing authentication credentials, making it a straightforward yet potent method for lateral data exfiltration within monitored networks.
To mitigate this risk, organizations running LibreNMS must immediately upgrade to version 26.9.0 or later, where the developers have implemented stricter input validation and path canonicalization checks in the affected module. Until an upgrade is feasible, administrators should consider restricting access to NFSen-enabled devices through network-level controls such as firewall rules or reverse proxy configurations that limit exposure of graph.php endpoints to only trusted IP ranges. Additionally, implementing strict role-based access control policies ensures that users are granted the minimum necessary permissions for their specific monitoring responsibilities, thereby reducing the blast radius if a single account is compromised. Regular auditing of user privileges and continuous monitoring for anomalous requests targeting file system paths can further enhance defense-in-depth strategies against such path traversal attacks.