{"id":86676,"date":"2026-03-13T09:13:22","date_gmt":"2026-03-13T09:13:22","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-54138-remote-file-inclusion-vulnerability-in-librenms","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-54138-remote-file-inclusion-vulnerability-in-librenms\/","title":{"rendered":"CVE-2025-54138: Remote File Inclusion Vulnerability in LibreNMS<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-54138 vulnerability is a high-risk security flaw found in LibreNMS versions 25.6.0 and below. This vulnerability could potentially allow remote code execution (RCE) if an attacker is able to manipulate the application’s file inclusion functionality. This presents a significant risk to organizations using affected versions of LibreNMS, potentially leading to system compromises and data breaches.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-54138
\nSeverity: High (CVSS: 7.5)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

LibreNMS | 25.6.0 and below<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of a flaw in the ajax_form.php endpoint of LibreNMS, which allows for Remote File Inclusion. The application directly uses the type parameter to dynamically include .inc.php files from a trusted path without validation, which potentially allows an attacker to execute arbitrary code if they can stage a file in the include path.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

This is a conceptual example of how an attacker might exploit the vulnerability:<\/p>\n

POST \/ajax_form.php HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/x-www-form-urlencoded\ntype=..\/..\/..\/malicious_file.inc.php<\/code><\/pre>\n
In this example, the attacker is attempting to include a malicious PHP file from outside the trusted path, which could lead to remote code execution if successful.<\/p>\n
Mitigation<\/strong><\/p>\n
Users are advised to upgrade to LibreNMS version 25.7.0 or later, which includes a fix for this vulnerability. As a temporary measure, users can also use a web application firewall (WAF) or intrusion detection system (IDS) to block attempts to exploit this vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-54138 vulnerability is a high-risk security flaw found in LibreNMS versions 25.6.0 and below. This vulnerability could potentially allow remote code execution (RCE) if an attacker is able to manipulate the application’s file inclusion functionality. This presents a significant risk to organizations using affected versions of LibreNMS, potentially leading to system compromises and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86676","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t