CPE
Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature, allowing an authenticated administrator to execute arbitrary commands via crafted filenames containing shell metacharacters.