Nagios XI Vulnerability CVE-2026-119742 Allows OS Command Injection

## Overview Nagios XI versions before 2026R2 contain a high-severity OS command injection vulnerability. This flaw exists in the MIB upload feature, specifically within the `install_mib()` function in `mibs.php`. The vulnerability arises from inadequate sanitization of uploaded filenames. ## Technical Details The `install_mib()` function uses a character-substitution filter that fails to account for semicolons, pipes, and certain whitespace characters. As a result, an authenticated administrator can upload a MIB file with a specially crafted filename. By using tab characters, an attacker can bypass the deny-list and execute arbitrary commands via a multipart POST request to `mibs.php`. This occurs when the filename is passed to a `grep` command executed through `exec()`, allowing the attacker to run commands as the web server user. ## Impact Successful exploitation of this vulnerability can lead to arbitrary OS command execution. This puts the integrity and security of the affected systems at risk. Attackers with admin access can leverage this flaw to execute malicious commands, potentially compromising the entire server. ## Mitigation Defenders should immediately update Nagios XI to version 2026R2 or later to close this vulnerability. Additionally, organizations should review access controls to ensure that only trusted administrators have upload capabilities. Regularly monitor logs for unusual activity related to MIB uploads and command executions.