{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3anagiosnagios_xi/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-119742"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nagios XI (\u003c 2026R2)"],"_cs_severities":["high"],"_cs_tags":["webserver","command-injection","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Nagios"],"content_html":"\u003cp\u003eNagios XI versions prior to 2026R2 are susceptible to OS command injection via the MIB upload functionality. The vulnerability exists within the install_mib() function in mibs.php, which fails to adequately sanitize uploaded filenames. Specifically, the character-substitution filter omits semicolons, pipes, and non-space IFS (Internal Field Separator) whitespace characters before passing the filename to a grep command executed via the system exec() function. An authenticated administrator can bypass this filter by utilizing tab characters within a multipart POST request to mibs.php, leading to command execution under the context of the web server user.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated administrator to execute arbitrary OS commands as the web server user, potentially leading to full system compromise of the Nagios XI server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Nagios XI to version 2026R2 or later immediately to patch the vulnerable install_mib() function.\u003c/li\u003e\n\u003cli\u003eReview administrative account activity for unauthorized access or suspicious changes to MIB configurations.\u003c/li\u003e\n\u003cli\u003eRestrict access to the MIB upload feature to only highly trusted administrative users until the patch is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T18:02:02Z","date_published":"2026-11-03T18:02:02Z","id":"https://feed.craftedsignal.io/briefs/2026-11-nagios-xi-mib-injection/","summary":"Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature, allowing an authenticated administrator to execute arbitrary commands via crafted filenames containing shell metacharacters.","title":"Nagios XI: OS command injection in MIB upload feature (CVE-2026-119742)","url":"https://feed.craftedsignal.io/briefs/2026-11-nagios-xi-mib-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}