What’s Vulnerable › Vulnerabilities

CVE-2021-3277

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 59.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-07 · updated 2026-06-17
• Weakness: CWE-434

Description

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.

Affected products

• Nagios XI: through 5.7.5

References

• https://asaf.me/2021/01/21/nagios-xi-5-7-5-remote-code-execution/
• https://asaf.me/2021/01/21/nagios-xi-5-7-5-remote-code-execution/

Get alerted when CVE-2021-3277 or the next vulnerability affects your stack