Live › vulnerability › CVE-2026-119742
Nagios XI before 2026R2 passes uploaded MIB filenames to a shell command using an incomplete character filter that misses semicolons and pipes. An attacker with administrator access can upload a file with a crafted name and run arbitrary commands as the web server user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 14:21 UTC. All times on this page are UTC.
Nagios XI installations before 2026R2 where an administrator can reach the MIB upload feature. The attacker must already hold administrator credentials, so instances with tight admin access and no exposure of the web interface are at lower risk. Teams running managed or unrelated Nagios products can skip it.
No product ranges from the sources yet.
2026R2.2026R2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character deny-list that omits semicolons and pipes before passing them to a grep command executed via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.
This page as .md · .json · in your agent: get_signal("CVE-2026-119742")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.