OS Command Injection in Nagios XI from Nagios

CVE-2026-119742

What is CVE-2026-119742?

Nagios XI versions prior to 2026R2 are susceptible to an OS command injection vulnerability within the MIB upload functionality. The vulnerability arises in the install_mib() function of mibs.php, which inadequately sanitizes filenames by utilizing an incomplete character deny-list, failing to account for critical characters such as semicolons and pipes. An authenticated administrator can exploit this flaw by uploading a malicious MIB file with specially crafted filenames that include tab characters, thereby circumventing the deny-list. This could lead to executing arbitrary OS commands under the privileges of the web server user through a multipart POST request, posing significant risks to the system's integrity and security.

References