Medium severity4.3NVD Advisory· Published Oct 12, 2026

CVE-2026-109354

Description

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traversed channel value to view traffic and NetFlow graphs of devices outside their authorized scope.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Librenms/Librenmsllm-fuzzy
Range: <26.9.0

Patches

Vulnerability mechanics

References

github.com/librenms/librenms/security/advisories/GHSA-j3qf-h24w-9f42nvd
www.vulncheck.com/advisories/librenms-before-26.9.0-path-traversal-via-nfsen-channel-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000