UpHeron
All vulnerabilities

Servers and applications

CVE-2024-13986

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible…

Severity
High 8.7
Published
28 Aug 2025
Last changed
26 Sept 2026
Added to UpHeron
1 Nov 2026
Fixed in
2024
Sources
NVD

Affected software

SoftwareAffected versions
Nagios XIServers and applications · cpe:a:nagios:nagios_xi
  • Version 2024-r1.3.1
  • Version 2024-r1.3
  • Version 2024-r1.2.2
  • Version 2024-r1.2.1
All 14 release lines
  • Every version before 2024
  • Version 2024-r1
  • Version 2024-r1.0.1
  • Version 2024-r1.1
  • Version 2024-r1.1.1
  • Version 2024-r1.1.2
  • Version 2024-r1.1.3
  • Version 2024-r1.1.4
  • Version 2024-r1.1.5
  • Version 2024-r1.2
  • Version 2024-r1.2.1
  • Version 2024-r1.2.2
  • Version 2024-r1.3
  • Version 2024-r1.3.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-13986
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-13986