CVE-2026-119742
Nagios XI < 2026R2 OS Command Injection via mibs.php
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.
| CWE | CWE-78 |
| Vendor | nagios enterprises, llc |
| Product | nagios xi |
| Published | Nov 3, 2026 |
| Last Updated | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for nagios enterprises, llc nagios xi
Be the first to know when new high vulnerabilities affecting nagios enterprises, llc nagios xi are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Nagios Enterprises, LLC / Nagios XI
0 < 2026R2
References
Credits
M. Cory Billington of theyhack.me