PT-2025-44469 · Nagios Enterprises · Nagios Xi

Tactifail · Published 2025-10-30 · Updated 2025-10-30 · CVE-2020-36863

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.7.2

Description Nagios XI versions prior to 5.7.2 permit the upload and execution of PHP files within the Audio Import directory. The upload process does not adequately restrict file types or ensure storage outside the webroot, and the web server allows execution within the upload directory. An authenticated attacker with access to the audio import feature can upload a malicious PHP file and then request it, leading to remote code execution with the privileges of the application service.

Recommendations Update to version 5.7.2 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-14518

CVE-2020-36863

Affected Products

Nagios Xi

References · 6

• https://bdu.fstec.ru/vul/2025-14518 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36863 · Vendor Advisory
• https://nagios.com/changelog/nagios-xi · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-36863 · Security Note
• https://vulncheck.com/advisories/nagios-xi-unrestricted-file-upload-via-audio-import-directory · Note
• https://twitter.com/CVEnew/status/1984030159167746316 · Twitter Post