CVE-2026-109354

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...