CVE-2025-65013: LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`

November 18, 2025 (updated November 19, 2025)

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without proper output encoding or sanitization, allowing an attacker to craft a URL that, when visited by a victim, causes arbitrary JavaScript execution in the victim’s browser.

References

github.com/advisories/GHSA-j8cq-7f6p-256x
github.com/librenms/librenms
github.com/librenms/librenms/security/advisories/GHSA-j8cq-7f6p-256x
nvd.nist.gov/vuln/detail/CVE-2025-65013

Code Behaviors & Features

Detect and mitigate CVE-2025-65013 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →