Nagios XI MIB upload OS command injection via mibs.php
Admins of this server-monitoring program can run commands on the server.
Summary
A flaw in how Nagios XI checks uploaded MIB filenames lets a logged-in administrator run arbitrary commands on the server. Versions before 2026R2 are affected.
Affected when
- Authenticated administrator access
What to do
Update to Nagios XI 2026R2.
Products and platforms
CVE IDs
Sources
- Advisory: nagios.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen