CVE-2024-14002 Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis

What is CVE-2024-14002?

CVE-2024-14002 is a high-severity path traversal vulnerability in Nagios Nagios Xi, published on 30 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.

Weakness: CWE-98

Which versions are affected by CVE-2024-14002?

It affects 1 product.

Products include Nagios Nagios Xi.

How do I fix CVE-2024-14002?

No fix has been published for CVE-2024-14002 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-14002 being exploited?

There is no known exploitation of CVE-2024-14002 in the wild and no public exploit code.

Other vulnerabilities in Nagios Nagios Xi

• CVE-2021-25296 Nagios XI OS Command Injection Exploited High 8.8
• CVE-2021-25297 Nagios XI OS Command Injection Exploited High 8.8
• CVE-2021-25298 Nagios XI OS Command Injection Exploited High 8.8
• CVE-2019-15949 Nagios XI Remote Code Execution Exploited High 8.8
• CVE-2024-24401 SQL injection in n/a Critical 9.8

All Nagios Nagios Xi vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qwgp-62r6-68mw.