{"id":"CVE-2026-119742","kind":"vulnerability","aliases":["CVE-2026-119742"],"related":[],"title":"Nagios XI: admin MIB upload lets a crafted filename run OS commands","description":"Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character deny-list that omits semicolons and pipes before passing them to a grep command executed via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.","summary":"Nagios XI before 2026R2 passes uploaded MIB filenames to a shell command using an incomplete character filter that misses semicolons and pipes. An attacker with administrator access can upload a file with a crafted name and run arbitrary commands as the web server user.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","monitoring","nagios-xi","php","self-hosted"],"not_affected_if":["2026r2-or-later","no-admin-exposure","not-nagios-xi"],"how_to_check":"- Check the installed Nagios XI version in the web UI or on the server with the product's version file, and compare it to `2026R2`.\n- Confirm whether the MIB upload feature is reachable by administrator accounts on the instance.","fix":"- Nagios XI: upgrade to `2026R2` or later.","status":"open","published_at":"2026-11-03T14:17:34+00:00","first_seen_at":"2026-11-03T14:21:08+00:00","triaged_at":"2026-11-03T14:22:01+00:00","updated_at":"2026-11-03T14:22:01+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-03T14:22:01Z","model":"claude-haiku-5-5","output":{"fix":"- Nagios XI: upgrade to `2026R2` or later.","reach":"network","title":"Nagios XI: admin MIB upload lets a crafted filename run OS commands","impact":"high","summary":"Nagios XI before 2026R2 passes uploaded MIB filenames to a shell command using an incomplete character filter that misses semicolons and pipes. An attacker with administrator access can upload a file with a crafted name and run arbitrary commands as the web server user.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["nagios-xi","self-hosted","monitoring","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Commands run as the web server user on the monitoring host","analyst_note":"Confirm the 2026R2 fixed version and whether the MIB upload feature is enabled by default, using the Nagios advisory and the VulnCheck page.","how_to_check":"- Check the installed Nagios XI version in the web UI or on the server with the product's version file, and compare it to `2026R2`.\n- Confirm whether the MIB upload feature is reachable by administrator accounts on the instance.","plain_action":"","needs_analyst":true,"not_affected_if":["not-nagios-xi","2026r2-or-later","no-admin-exposure"],"who_is_affected":"Nagios XI installations before 2026R2 where an administrator can reach the MIB upload feature. The attacker must already hold administrator credentials, so instances with tight admin access and no exposure of the web interface are at lower risk. Teams running managed or unrelated Nagios products can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4224,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119742':15A,18A '-2026':14A,17A '2026r2':31B,75C 'access':54B 'admin':3A 'administr':53B,121C 'arbitrari':65B,153C 'attack':51B 'authent':120C 'bypass':135C 'charact':43B,100C,133C 'command':12A,39B,66B,79C,115C,155C 'contain':76C 'craft':8A,61B,129C 'cve':13A,16A 'deni':102C,138C 'deny-list':101C,137C 'exec':118C 'execut':116C,156C 'featur':86C 'file':58B,126C 'filenam':9A,35B,96C,130C 'filter':44B 'function':91C 'grep':114C 'host':27B 'incomplet':42B,99C 'infrastructur':19B 'inject':80C 'instal':89C 'let':6A 'list':103C,139C 'mib':4A,34B,84C,90C,125C 'mibs.php':93C,150C 'miss':46B 'monitor':20B 'multipart':146C 'nagio':1A,22B,28B,72C 'nagios-xi':21B 'name':62B 'omit':105C 'os':11A,78C,154C 'pass':32B,110C 'php':24B 'pipe':49B,108C,141C 'post':147C 'request':148C 'result':151C 'run':10A,64B 'sanit':94C 'self':26B 'self-host':25B 'semicolon':47B,106C 'server':70B,160C 'sh':143C 'shell':38B 'tab':132C 'upload':5A,33B,56B,85C,95C,123C 'use':40B,131C 'user':71B,161C 'via':117C,144C 'vulner':81C 'web':69B,159C 'xi':2A,23B,29B,73C","nicknames":[],"mitigations":[],"who_affected":"Nagios XI installations before 2026R2 where an administrator can reach the MIB upload feature. The attacker must already hold administrator credentials, so instances with tight admin access and no exposure of the web interface are at lower risk. Teams running managed or unrelated Nagios products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","monitoring","nagiosxi","php","selfhosted"],"first_public_at":"2026-11-03T14:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119742","severity":null,"published_at":"2026-11-03T14:17:34+00:00","modified_at":"2026-11-03T14:17:34+00:00","first_seen_at":"2026-11-03T14:21:08+00:00","fetched_at":"2026-11-03T14:21:08+00:00","note":null}],"documents":[{"id":58015,"url":"https://www.vulncheck.com/advisories/nagios-xi-2026r2-os-command-injection-via-mibs-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}