CVE-2026-6204 Details

A remote code execution vulnerability has been identified in LibreNMS versions prior to 26.3.0. This vulnerability allows authenticated administrators to execute arbitrary code on the server by manipulating the 'Binary Locations' configuration and using the Netcommand feature. Exploitation involves bypassing input validation to execute malicious scripts, potentially compromising the underlying web server.

Users are advised to update LibreNMS to version 26.3.0 or later. For versions prior to 26.3.0, consider loading binary paths from a configuration file instead of the WebUI, or enforce stricter validations to prevent the bypass that allows remote code execution.