CVE-2026-119742
HIGH
MEDIUM
Priority: 0.35
BB Relevance:
63/100
Published: 2026-11-03
Modified: 2026-11-03
First seen: 2026-11-03
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
AT:
None
VC:
High
VI:
High
VA:
High
Description
Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Nagios Enterprises, LLC | Nagios XI | 0 < 2026R2 |
| Nagios Enterprises, LLC | Nagios XI | 0 < 2026R2 |
| Nagios Enterprises, LLC | Nagios XI | 0 < 2026R2 |
References & Advisories (2)
third-party-advisory
release-notes
patch