CVE-2026-55182 in LibreNMS
Summary
by MITRE • 08/27/2026
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within LibreNMS versions ranging from 21.6.0 to 26.5.0 represents a critical security flaw rooted in improper neutralization of special elements used in an operating system command, commonly categorized under CWE-78. This specific instance involves the Signal alert transport mechanism, which is designed to send notifications via the Signal messaging platform. The core technical deficiency lies in the insufficient escaping and validation of user-supplied input before it is passed to shell execution functions. Specifically, two distinct fields within an alert transport entry are susceptible: the signal-cli path configuration and the Recipient field. When these inputs are processed by the application's backend logic, they are directly interpolated into command-line strings without adequate sanitization, creating a direct pathway for arbitrary code execution if controlled by an attacker with administrative privileges.
The exploitation of this vulnerability requires authentication as an administrator within the LibreNMS environment. This privilege level is necessary because it grants access to the configuration interfaces where alert transports and their associated parameters are defined. An authenticated adversary can craft a malicious transport entry that exploits two layers of unsafe execution. First, by manipulating the Recipient field to include shell metacharacters such as semicolons or pipe characters, the attacker introduces commands that will be executed alongside the intended Signal message sending operation. Second, and more critically, the vulnerability is compounded by how the signal-cli path parameter interacts with a bundled script named composer_wrapper.php. This wrapper script acts as an intermediary layer but fails to properly validate its inputs before passing them to further exec calls. By chaining these unsafe operations, an attacker can bypass initial checks and achieve arbitrary command execution on the underlying host operating system.
The operational impact of this vulnerability is severe, effectively resulting in a complete compromise of the LibreNMS server's integrity and availability. Since the commands are executed with the privileges of the web application user or potentially escalated depending on system configuration, an attacker can read sensitive configuration files containing database credentials, modify network monitoring configurations to hide malicious activity, install backdoors for persistent access, or pivot into other parts of the internal network by scanning from the compromised host. This aligns with ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically lateral movement through remote services if the server has broader network access, as well as data exfiltration capabilities inherent in arbitrary command execution. The existence of this flaw undermines the trust placed in LibreNMS as a secure monitoring solution for critical infrastructure.
Mitigation strategies must prioritize immediate remediation by upgrading to version 26.5.0 or later, where these input validation and escaping mechanisms have been corrected. For environments unable to upgrade immediately due to compatibility constraints, temporary mitigations should focus on restricting administrative access through strict role-based access control and network segmentation. Additionally, implementing a Web Application Firewall with rulesets capable of detecting shell metacharacter injection in HTTP parameters can provide an additional layer of defense against exploitation attempts. It is also advisable to audit existing alert transport configurations for any anomalous entries that may indicate prior compromise or testing by malicious actors. Regular security assessments and adherence to secure coding practices, particularly regarding the handling of external input before system command invocation, are essential to prevent similar vulnerabilities in future development cycles.