CVE-2026-119742

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2026R2

Description An OS command injection issue exists in the MIB upload feature. The install mib() function in the mibs.php file uses an incomplete character-substitution filter when sanitizing uploaded filenames, failing to remove semicolons, pipes, and non-space IFS whitespace characters. These filenames are subsequently passed to a grep command executed via exec(). An authenticated administrator can exploit this by sending a multipart POST request to the mibs.php endpoint with a crafted filename containing tab characters to bypass the deny-list and pipe commands to sh, allowing arbitrary OS command execution with the privileges of the web server user.

Recommendations Update Nagios XI to version 2026R2. As a temporary mitigation, restrict access to the mibs.php endpoint to only trusted administrators.