UBUNTU-CVE-2026-119742
Dashboard / Vulnerabilities / UBUNTU-CVE-2026-119742
Summary:
Details: Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.
References: https://ubuntu.com/security/CVE-2026-119742, https://www.cve.org/CVERecord?id=CVE-2026-119742, https://www.nagios.com/security-disclosures/nagios-xi/2026r2/, https://www.vulncheck.com/advisories/nagios-xi-2026r2-os-command-injection-via-mibs-php
Affected packages
Package
Name: nagios3
Purl: pkg:deb/ubuntu/nagios3?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
