parlakbarann/cve-2026-30480Proof-of-concept for CVE-2026-30480, a Local File Inclusion vulnerability in LibreNMS NFSen module, demonstrating path traversal to include arbitrary PHP files and impact analysis.
| Field | Value |
|---|
| Product | LibreNMS |
| Vendor | LibreNMS Project |
| Vulnerability Type | Local File Inclusion (LFI) / Path Traversal |
| CWE | CWE-98, CWE-22 |
| CVSS Score | 7.5 - 8.5 (High) |
| Authentication Required | Yes |
| Discovery Date | 2026-02-01 |
File: includes/html/pages/device/nfsen.inc.php
Lines: 46-48
if (is_file('includes/html/pages/device/nfsen/' . $vars['nfsen'] . '.inc.php')) {
include 'includes/html/pages/device/nfsen/' . $vars['nfsen'] . '.inc.php';
} else {
include 'includes/html/pages/device/nfsen/general.inc.php';
}
The $vars['nfsen'] parameter is derived from user input ($_GET/$_POST) and is directly concatenated into the include() statement without proper sanitization. The only validation performed is an is_file() check, which does not prevent path traversal sequences.
../)is_file() only checks existence, not path safetyLogin to LibreNMS as any authenticated user
Navigate to any device's Netflow tab:
https://[TARGET]/device/[DEVICE_ID]/tab=netflow
Append the malicious parameter:
https://[TARGET]/device/[DEVICE_ID]/tab=netflow?nfsen=..%2f..%2fapi-access
Observe that the API Access page content is loaded instead of NFSen content
| Scenario | Expected | Actual |
|---|---|---|
| Normal request | NFSen General page (Flows, Packets, Traffic) | NFSen General page |
| Malicious request | NFSen General page | API Access page content |
| Impact Type | Description |
|---|---|
| Information Disclosure | Include and execute arbitrary .inc.php files |
| Privilege Escalation | Access admin-only pages as low-privileged user |
| Potential RCE | If attacker can control content of any .inc.php file |
URL: https://[REDACTED]/about
Version: 22.11.0-23-gd091788f2 (Thu Dec 15 2022)
Description: LibreNMS version information showing the tested version. This version is after the CVE-2021-44278 patch (v21.12.0), confirming this is a new, unpatched vulnerability.
URL: https://[REDACTED]/device/114/tab=netflow
Description: Normal NFSen/Netflow page showing Flows, Packets, and Traffic sections. This is the expected behavior without exploitation.
URL: https://[REDACTED]/device/114/tab=netflow?nfsen=..%2f..%2fapi-access
Payload: ..%2f..%2fapi-access (URL encoded path traversal)
Description: When the malicious payload is injected, the API Access page content is loaded instead of NFSen content. This demonstrates successful Local File Inclusion - the api-access.inc.php file was included instead of general.inc.php.
URL: https://[REDACTED]/device/114/tab=netflow?nfsen=..%2f..%2fapi-access
Payload: ..%2f..%2fapi-access (URL encoded path traversal)
Description: Same exploit attempted with a lower-privileged user (Global Read). The page shows "You have insufficient permissions to view this page" error. This confirms:
showconfig.inc.php and was patched in v21.12.0). This vulnerability affects nfsen.inc.php and remains unpatched.Implement whitelist-based validation:
$allowed_pages = ['general', 'stats', 'channel'];
if (in_array($vars['nfsen'], $allowed_pages, true)) {
include 'includes/html/pages/device/nfsen/' . $vars['nfsen'] . '.inc.php';
} else {
include 'includes/html/pages/device/nfsen/general.inc.php';
}
Use basename() to strip path traversal:
$nfsen_page = basename($vars['nfsen']);
if (is_file('includes/html/pages/device/nfsen/' . $nfsen_page . '.inc.php')) {
include 'includes/html/pages/device/nfsen/' . $nfsen_page . '.inc.php';
}
| Date | Action |
|---|---|
| 2026-02-01 | Vulnerability discovered |
| 2026-04-14 | CVE published, vendor notified |
| 2026-04-14 | Public disclosure |
This vulnerability report is provided for educational and authorized security research purposes only. The researcher followed responsible disclosure practices by notifying the vendor before public disclosure.
Discovered by: Ömer Baran Parlak
Contact: [email protected]
GitHub: parlakbarann