Is CVE-2026-109354 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109354?

CVE-2026-109354 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-109354

Description

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traversed channel value to view traffic and NetFlow graphs of devices outside their authorized scope.