What’s Vulnerable › Vulnerabilities

CVE-2024-13986: Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-28 · updated 2026-09-26
• Weakness: CWE-22

Description

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible directory, executed as the www-data user.

Affected products

• Nagios XI: before 2024; 2024-r1, 2024-r1.0.1, 2024-r1.1, 2024-r1.1.1, 2024-r1.1.2, 2024-r1.1.3 (+7) — fixed in 2024

How to fix

Upgrade to a fixed version: Nagios XI 2024. Check the vendor advisory for mitigations.

References

• https://theyhack.me/Nagios-XI-Authenticated-RCE
• https://www.nagios.com/changelog/nagios-xi/
• https://www.nagios.com/products/security/#nagios-xi
• https://www.vulncheck.com/advisories/nagios-xi-authenticated-arbitrary-file-upload-path-traversal-rce
• https://theyhack.me/Nagios-XI-Authenticated-RCE/

Get alerted when CVE-2024-13986 or the next vulnerability affects your stack