CVE-2020-36867: Nagios XI < 5.7.3 Command Injection in Report PDF Download

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-30 · updated 2026-10-18
Weakness: CWE-78

Description

Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped, allowing an authenticated attacker who can trigger PDF exports to inject shell metacharacters or arguments.

Affected products

Nagios XI: before 5.7.3 — fixed in 5.7.3

How to fix

Upgrade to a fixed version: Nagios XI 5.7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36867 or the next vulnerability affects your stack