Nagios XI prior to version 2026R2 is affected by an OS command injection vulnerability in the MIB upload feature. The install_mib() function sanitizes uploaded filenames with an incomplete deny‑list that omits semicolons and pipes, while the same filename is passed to a grep command executed via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny‑list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user. This compromise can affect confidentiality, integrity, and availability of the host.

Nagios Enterprises, LLC provides Nagios XI, and all installations of Nagios XI versions older than 2026R2 are vulnerable. No further version granularity is specified.

The CVSS score of 8.6 signifies high severity, and the EPSS score is currently unavailable, which does not diminish the risk. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is administrative access: an attacker who can authenticate as an administrator can upload a malicious MIB file and execute arbitrary OS commands. The risk is significant in environments where administrative credentials are weak or exposed, and the impact is potentially system‑wide.