{"id":"GHSA-q5rg-wg7h-73m5","aliases":["CVE-2019-10665"],"title":"LibreNMS Information Disclosure","description":"An issue was discovered in LibreNMS through 1.47. The scripts that handle graphing options (`html/includes/graphs/common.inc.php` and `html/includes/graphs/graphs.inc.php`) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with `mysqli_real_escape_string`, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the `html/graph.php` script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.","severity":"critical","score":9.8,"published":"2022-05-24T16:55:40.000Z","modified":"2026-03-06T15:16:30.633Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"librenms/librenms","ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.47"}],"type":"ECOSYSTEM"}],"versions":["1.19","1.20","1.20.1","1.21","1.22","1.22.01","1.23","1.24","1.25","1.26","1.27","1.28","1.29","1.30","1.30.01","1.31","1.31.01","1.31.02","1.31.03","1.32","1.32.01","1.33","1.33.01","1.34","1.35","1.36","1.36.01","1.37","1.38","1.39","1.40","1.41","1.42","1.42.01","1.43","1.44","1.45","1.46","1.47"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2019-10665","https://github.com/librenms/librenms","https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023"],"sources":[{"name":"OSV","id":"GHSA-q5rg-wg7h-73m5","modified":"2026-03-06T15:16:30.633486Z","url":"https://osv.dev/vulnerability/GHSA-q5rg-wg7h-73m5"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}]}