{"id":"CVE-2026-119742","published":"2026-11-03T14:17:34.843","lastModified":"2026-11-03T16:25:21.310","description":"Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.","cvssScore":7.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://www.nagios.com/security-disclosures/nagios-xi/2026r2/","tags":[]},{"url":"https://www.vulncheck.com/advisories/nagios-xi-2026r2-os-command-injection-via-mibs-php","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}