CVE-2025-54138

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without validation or allowlisting. This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities. This is fixed in version 25.7.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

Vendor	Product	Versions
librenms	librenms	< 25.7.0

References

https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81Patch
https://github.com/librenms/librenms/pull/17990Issue Tracking
https://github.com/librenms/librenms/releases/tag/25.7.0Release Notes
https://github.com/librenms/librenms/security/advisories/GHSA-gq96-8w38-hhj2Exploit, Vendor Advisory

Timeline

Published: Jul 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-541396.1HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in hax CVE-2025-541407.5pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerab CVE-2025-541417.5ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3,CVE-2025-541424.0Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subseque CVE-2025-541439.8Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the p CVE-2025-541445.4The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or i CVE-2025-541459.1The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's ope CVE-2025-541466.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-541476.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-541486.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-541495.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they CVE-2025-541505.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they