Nagios XI
CVE-2025-67254
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Nagios XI admin panel
-
ExploitSend traversal payload to coreconfigsnapshots.php
-
ExecutionEscape intended snapshot directory
-
ImpactRead arbitrary server files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires reaching /admin/coreconfigsnapshots.php and supplying a path/file parameter with directory-traversal sequences. The /admin/ path convention in Nagios XI indicates an administrative interface that normally requires a logged-in administrator session, which is the primary limiting factor and contradicts the NVD PR:N rating - defenders should treat authenticated admin access as a likely prerequisite until the vendor confirms otherwise. Impact is confined to reading files the web server process can access (confidentiality only; no write or availability impact). Specific affected build is Nagios XI 2026R1.0.1 (build 1762361101); other versions' exposure is not confirmed from available data. |
| Impact | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5 High) models a remote, unauthenticated, low-complexity read-only file disclosure. However, this conflicts with the description: the vulnerable endpoint is /admin/coreconfigsnapshots.php, and in Nagios XI the /admin/ area normally requires an authenticated administrative session - so the PR:N (no privileges) metric is questionable and should be verified with the vendor, as it materially changes real-world severity. EPSS is 2.04% (81st percentile): modestly elevated but not indicative of imminent mass exploitation. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation. A reference points to a security researcher's GitHub repository (YongYe-Security/NagiosXI), which strongly suggests publicly available exploit/PoC code exists, though I could not independently verify its contents. Net assessment: a credible, likely-authenticated information-disclosure flaw in widely deployed monitoring software - a real priority to patch, but probably lower urgency than the raw 7.5/PR:N suggests if admin authentication is in fact required. |
| Exploit ScenarioDerived | An attacker with access to the Nagios XI admin interface (or, if the NVD PR:N rating holds, a remote unauthenticated attacker) sends a crafted request to /admin/coreconfigsnapshots.php containing directory-traversal sequences (e.g. ../../) in a file parameter. The server resolves the path outside the intended directory and returns the contents of arbitrary files such as configuration files or credentials. Exploit code is likely available via the referenced researcher GitHub repository, lowering the barrier to abuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Directory traversal in Nagios XI 2026R1.0.1 (build 1762361101) lets a user who can reach the administrative /admin/coreconfigsnapshots.php page supply crafted path sequences and read files on the underlying host that are accessible to the web server process. The NVD score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) models this as remote and unauthenticated, but the /admin/ path convention indicates an administrative interface that normally requires a logged-in administrator session, so our assessment rates the prerequisite as PR:H (authenticated administrator) until the vendor clarifies. Impact is confidentiality-only - no file write or availability loss - and no public exploit code or active exploitation has been identified at time of analysis, though EPSS places the flaw at roughly the 81st percentile (2.04%), indicating elevated relative attention.
RemediationAI
No vendor-released patch was identified in the available data for CVE-2025-67254, so remediation must currently rely on compensating controls while the vendor advisory and version matrix are confirmed (monitor https://www.nagios.org/ and the NVD record). The highest-value control is to restrict access to the /admin/ administrative interface - for example by binding it to a management VLAN, an allow-listed set of source IPs, or a VPN/reverse-proxy with authentication - which directly removes the reachability that the exploit depends on, at the cost of complicating legitimate administrator access. If the core configuration snapshot feature is not required operationally, disabling or blocking /admin/coreconfigsnapshots.php at the reverse proxy or WAF (denying requests whose parameters contain encoded or plain '..' sequences, and normalizing %2e%2e / double-encoding variants) reduces exposure but may break configuration backup workflows and can be bypassed if the WAF does not perform full path canonicalization. Additionally, run the Nagios XI web server under a least-privilege account, apply filesystem permissions and AppArmor/SELinux confinement or a chroot so that the httpd process cannot read sensitive files such as /etc/shadow, config.inc.php, or SSH keys, and enforce strong administrator authentication with MFA and session auditing so that any abuse of the endpoint is logged and attributable. Because the endpoint is administrative, treat any account able to reach it as privileged and rotate credentials if traversal attempts are observed in web logs.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the PHP-based administrative web interface of Nagios XI, specifically coreconfigsnapshots.php, the script that serves core configuration snapshot files under the /admin/ directory. The root cause class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): user-controllable input used to build a filesystem path is not canonicalized or validated against traversal sequences such as ../, allowing the resolved path to escape the intended snapshot directory. Because the affected functionality is a read/download style operation, the realistic primitive is arbitrary file disclosure limited to the privileges of the web server account (typically apache/nagios), which is why the impact vector is C:H/I:N/A:N rather than code execution. The CPE string cpe:2.3:a:nagios:nagios_xi:2026:r1.0.1:*:*:*:*:*:* pins the confirmed exposure to the 2026R1.0.1 release; the presence of an administrative route prefix also means reachability of the endpoint - not merely network exposure of the Nagios XI host - is the gating condition for exploitation.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The /admin/ endpoint implies an authenticated administrative session, so PR:H rather than NVD's PR:N; read-only traversal yields C:H with no integrity or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.
Executive ViewAI
Nagios XI 2026R1.0.1 (build 1762361101) is affected by a directory traversal flaw that could let an attacker read host files accessible to the Nagios web service, potentially exposing configuration data or credentials. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, so organizations running this version must rely on access restrictions and monitoring until a fix is available. Leadership should prioritize confirming exposure, tightening administrative access, and planning an upgrade path.
No vendor-released patch identified at time of analysis. Restrict /admin/coreconfigsnapshots.php and /admin/ to trusted management networks or VPN, enforce MFA for Nagios XI administrators, deploy WAF/reverse-proxy rules to block directory traversal sequences, run the web server as a low-privilege account, audit and minimize file permissions accessible to the web process, and monitor logs for anomalous file-read attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB