CVE-2020-36863

Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not properly restrict file types or enforce storage outside of the webroot, and the web server permitted execution within the upload directory. An authenticated attacker with access to the audio import feature could upload a crafted PHP file and then request it to achieve remote code execution with the privileges of the application service.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.nagios.com/changelog/nagios-xi/	Release Notes
https://www.vulncheck.com/advisories/nagios-xi-unrestricted-file-upload-via-audio-import-directory	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*

History

18 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Nagios XI anteriores a la 5.7.2 permiten que se suban archivos PHP al directorio de Importación de Audio y se ejecuten desde esa ubicación. El gestor de subida no restringía adecuadamente los tipos de archivo ni forzaba el almacenamiento fuera del webroot, y el servidor web permitía la ejecución dentro del directorio de subida. Un atacante autenticado con acceso a la función de importación de audio podría subir un archivo PHP manipulado y luego solicitarlo para lograr la ejecución remota de código con los privilegios del servicio de la aplicación.

Information

Published : 2025-10-30 22:15

Updated : 2026-10-18 00:10

NVD link : CVE-2020-36863

Mitre link : CVE-2020-36863

CVE.ORG link : CVE-2020-36863

JSON object : View

Products Affected

nagios

nagios_xi

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2020-36863", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2020-36863", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-31T13:05:33.935556Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Nagios", "modules": ["Audio import directory / upload handler (web UI/API)", "Web server configuration for upload directory execution"], "product": "XI", "versions": [{"status": "affected", "version": "0", "lessThan": "5.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-30T22:15:39.150", "references": [{"url": "https://www.nagios.com/changelog/nagios-xi/", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nagios-xi-unrestricted-file-upload-via-audio-import-directory", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Nagios XI versions prior to\u00a05.7.2\u00a0allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not properly restrict file types or enforce storage outside of the webroot, and the web server permitted execution within the upload directory. An authenticated attacker with access to the audio import feature could upload a crafted PHP file and then request it to achieve remote code execution with the privileges of the application service."}, {"lang": "es", "value": "Las versiones de Nagios XI anteriores a la 5.7.2 permiten que se suban archivos PHP al directorio de Importaci\u00f3n de Audio y se ejecuten desde esa ubicaci\u00f3n. El gestor de subida no restring\u00eda adecuadamente los tipos de archivo ni forzaba el almacenamiento fuera del webroot, y el servidor web permit\u00eda la ejecuci\u00f3n dentro del directorio de subida. Un atacante autenticado con acceso a la funci\u00f3n de importaci\u00f3n de audio podr\u00eda subir un archivo PHP manipulado y luego solicitarlo para lograr la ejecuci\u00f3n remota de c\u00f3digo con los privilegios del servicio de la aplicaci\u00f3n."}], "lastModified": "2026-10-18T00:10:00.123", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE3BA539-3665-4DF4-9F54-EF07E78BE025", "versionEndExcluding": "5.7.2"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}