LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint /maps/nodeimage parameter Image Name

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

EPSS

• CVE-2025-65013: 0.27% estimated exploitation activity in the next 30 days; percentile 19.59 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without proper output encoding or sanitization, allowing an attacker to craft a URL that, when visited by a victim, causes arbitrary JavaScript execution in the victim’s browser. Details - Vulnerable Endpoint: GET /maps/nodeimage - Parameter: Image Name (reflected in response) - Vulnerability type: Reflected Cross-Site Scripting (XSS) — input is reflected in server response and executed in victim browser. - CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) Description The application takes the value of the Image Name parameter from a request to /maps/nodeimage and includes it in the generated page or response without proper contextual encoding. Because the input is reflected immediately back to the client and parsed as HTML/JavaScript by the…

Published by the source

18 Nov 2025, 18:21 UTC

Last modified by the source

19 Nov 2025, 14:22 UTC

Source last checked

26 Oct 2026, 14:34 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-j8cq-7f6p-256x

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2025-65013

Advisory: LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`
IDs: CVE-2025-65013, GHSA-j8cq-7f6p-256x
Record: https://patchnext.com/advisories/cve-2025-65013 (revision 1, source checked 26 Oct 2026, 14:34 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.2)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: librenms/librenms 25.11.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist librenms/librenms: affected < 25.11.0; fixed in 25.11.0

## Suggested inspection (read-only)
- Packagist librenms/librenms: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on librenms/librenms.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-j8cq-7f6p-256x (GitHub-reviewed advisory GHSA-j8cq-7f6p-256x lists affected ranges: Packagist librenms/librenms >=0 <25.11.0)

Commands are suggestions: review each one before running it.