Command Injection Vulnerability in Nagios XI by Nagios Enterprises
CVE-2020-36867

8.7HIGH

Key Information:

Vendor

NagiOS

Status
Xi
Vendor
CVE Published:
30 October 2025

What is CVE-2020-36867?

Nagios XI before version 5.7.3 contains a command injection flaw within its PDF download/export feature. This vulnerability arises from insufficient validation and improper escaping of user-supplied inputs in the PDF generation pipeline. An authenticated attacker, possessing the ability to initiate PDF exports, can exploit this flaw to inject shell metacharacters or arguments, potentially compromising the security of the system.

Affected Version(s)

XI 0 < 5.7.3

References

https://www.nagios.com/changelog/nagios-xi/
release-notespatch
https://www.vulncheck.com/advisories/nagios-xi-command-in...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Christian Weiler
JSON
.
CVE-2020-36867 : Command Injection Vulnerability in Nagios XI by Nagios Enterprises