CVE-2025-54138

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54138
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without validation or allowlisting. This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities. This is fixed in version 25.7.0.
CVSS

No CVSS.

References
Link Resource
https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81 Patch
https://github.com/librenms/librenms/pull/17990 Issue Tracking
https://github.com/librenms/librenms/releases/tag/25.7.0 Release Notes
https://github.com/librenms/librenms/security/advisories/GHSA-gq96-8w38-hhj2 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*
History

05 Aug 2025, 17:52

Type Values Removed Values Added
First Time Librenms librenms
Librenms
CPE cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*
References () https://github.com/librenms/librenms/releases/tag/25.7.0 - () https://github.com/librenms/librenms/releases/tag/25.7.0 - Release Notes
References () https://github.com/librenms/librenms/security/advisories/GHSA-gq96-8w38-hhj2 - () https://github.com/librenms/librenms/security/advisories/GHSA-gq96-8w38-hhj2 - Exploit, Vendor Advisory
References () https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81 - () https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81 - Patch
References () https://github.com/librenms/librenms/pull/17990 - () https://github.com/librenms/librenms/pull/17990 - Issue Tracking

22 Jul 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-22 22:15

Updated : 2025-08-05 17:52

NVD link : CVE-2025-54138

Mitre link : CVE-2025-54138

JSON object : View

Products Affected

librenms

  • librenms
CWE
CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')