CVE-2020-36868: nagios nagios_xi External Control of File Name or Path

Vulnerability summary

CVE-2020-36868 is a high (CVSS 8.5) External Control of File Name or Path vulnerability in nagios nagios_xi. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.9% of scored vulnerabilities.

Timeline

1. 30-10-2025
   PublishedVulnerability first disclosed.
2. 17-11-2025
   Last modifiedVulnerability information updated.

Description

Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some deployments executed with elevated privileges. A local attacker with low-level access could exploit these weaknesses to cause the script to execute arbitrary commands or modify privileged files, resulting in privilege escalation.

• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
• CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.