Unrestricted File Upload Vulnerability in Nagios XI by Nagios
CVE-2020-36863

8.7HIGH

Key Information:

Vendor

NagiOS

Status
Xi
Vendor
CVE Published:
30 October 2025

What is CVE-2020-36863?

An issue in Nagios XI prior to version 5.7.2 allows for the upload of PHP files to the Audio Import directory, which can be executed due to insufficient restrictions on file types and improper storage management outside the webroot. This flaw enables authenticated attackers to exploit the audio import feature by uploading malicious PHP files, leading to potential remote code execution under the application's service privileges.

Affected Version(s)

XI 0 < 5.7.2

References

https://www.nagios.com/changelog/nagios-xi/
release-notespatch
https://www.vulncheck.com/advisories/nagios-xi-unrestrict...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TactiFail
JSON
.
CVE-2020-36863 : Unrestricted File Upload Vulnerability in Nagios XI by Nagios