Reflected XSS via unescaped Proxmox page title

Reflected XSS in LibreNMS before 26.5.0 allows remote authenticated users to execute script through a crafted Proxmox app link. The Proxmox view adds instance and vmid GET values to the page title after only strip_tags, and LegacyController interpolates that title into a single-quoted document.title assignment. Exploitation requires an authenticated victim to follow the link; the injected script then runs in that victim's LibreNMS session and can read session data or act with the victim's access.