Threats tagged 'ghsa-xgjr-r6p2-hvm3'

Nagios XI versions prior to 2026R2 have an OS command injection vulnerability in the MIB upload feature. The vulnerability arises because the install_mib() function in mibs.php inadequately sanitizes uploaded filenames, omitting certain characters like semicolons, pipes, and some whitespace characters. An authenticated administrator can exploit this by uploading a crafted MIB file with tab characters in the filename to bypass filtering and execute arbitrary OS commands as the web server user.