CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119742?
CVE-2026-119742 is a high-severity vulnerability in Nagios XI, published on 3 Nov 2026.
Official description
Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.
Weakness: CWE-78
Which versions are affected by CVE-2026-119742?
How do I fix CVE-2026-119742?
No fix has been published for CVE-2026-119742 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119742 being exploited?
There is no known exploitation of CVE-2026-119742 in the wild and no public exploit code.
Sources
Also known as GHSA-xgjr-r6p2-hvm3, UBUNTU-CVE-2026-119742.