CVE-2026-27016 – LibreNMS has Stored XSS in Custom OID – unit parameter missing strip_tags()

CVE ID : CVE-2026-27016

Published : Feb. 20, 2026, 2:16 a.m. | 44 minutes ago

Description : LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.

Severity: 5.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…