Nagios XI: OS command injection in MIB upload feature (CVE-2026-119742)

Nagios XI versions prior to 2026R2 are susceptible to OS command injection via the MIB upload functionality. The vulnerability exists within the install_mib() function in mibs.php, which fails to adequately sanitize uploaded filenames. Specifically, the character-substitution filter omits semicolons, pipes, and non-space IFS (Internal Field Separator) whitespace characters before passing the filename to a grep command executed via the system exec() function. An authenticated administrator can bypass this filter by utilizing tab characters within a multipart POST request to mibs.php, leading to command execution under the context of the web server user.

Impact

Successful exploitation allows an authenticated administrator to execute arbitrary OS commands as the web server user, potentially leading to full system compromise of the Nagios XI server.

Recommendation

• Upgrade Nagios XI to version 2026R2 or later immediately to patch the vulnerable install_mib() function.
• Review administrative account activity for unauthorized access or suspicious changes to MIB configurations.
• Restrict access to the MIB upload feature to only highly trusted administrative users until the patch is applied.