CVE-2026-119742

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

CVE-2026-119742

Nagios XI versions prior to 2026R2 are vulnerable to an OS command injection flaw in the MIB upload feature. The root cause is located in the install_mib() function within mibs.php, which employs an incomplete character deny-list that fails to filter semicolons and pipes. An authenticated adminis...

EUVD-2026-115824

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...