CVE-2020-36863: Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-30 · updated 2026-10-18
Weakness: CWE-434

Description

Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not properly restrict file types or enforce storage outside of the webroot, and the web server permitted execution within the upload directory. An authenticated attacker with access to the audio import feature could upload a crafted PHP file and then request it to achieve remote code execution with the privileges of the application service.

Affected products

Nagios XI: before 5.7.2 — fixed in 5.7.2

How to fix

Upgrade to a fixed version: Nagios XI 5.7.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36863 or the next vulnerability affects your stack