CVE-2018-25122: Nagios XI < 5.4.13 Component Download Page RCE

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-30 · updated 2026-10-18
Weakness: CWE-78

Description

Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inject commands or otherwise execute arbitrary code with the privileges of the application service.

Affected products

Nagios XI: before 5.4.13 — fixed in 5.4.13

How to fix

Upgrade to a fixed version: Nagios XI 5.4.13. Check the vendor advisory for mitigations.

References

https://www.nagios.com/changelog/nagios-xi/
https://www.vulncheck.com/advisories/nagios-xi-component-download-page-rce

Get alerted when CVE-2018-25122 or the next vulnerability affects your stack