CVE-2025-54138: Librenms remote code execution (CVSS 7.5)

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without validation or allowlisting. This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities. This is fixed in version 25.7.0.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Librenms< 25.7.0

Remediation

Fixed in

Librenms≥ 25.7.0

Patch & vendor advisories

References

https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81Patch
https://github.com/librenms/librenms/pull/17990Issue Tracking
https://github.com/librenms/librenms/releases/tag/25.7.0Release Notes
https://github.com/librenms/librenms/security/advisories/GHSA-gq96-8w38-hhj2ExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-54138 being actively exploited?

CVE-2025-54138 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 1.07%.

How severe is CVE-2025-54138?

CVE-2025-54138 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 1.07% probability of exploitation.

Which products are affected by CVE-2025-54138?

Affected products include Librenms.

How do I fix CVE-2025-54138?

Upgrade affected software to a fixed version, for example Librenms 25.7.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-54138 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo