TI-2020-19002 Aliases CVE-2020-36867 GHSA-3qxh-pr59-jwh7

Nagios XI < 5.7.3 Command Injection in Report PDF Download

MEDIUM 44CWE-78Published 2025-10-30 · Updated 2025-11-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped, allowing an authenticated attacker who can trigger PDF exports to inject shell metacharacters or arguments.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02546 85th percentileScored 2026-11-07

Fix Fixed XI (Nagios): 5.7.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Nagios	XI	before 5.7.3	5.7.3	Patch available	CNA

XI VendorNagios Affected before 5.7.3 Fixed in 5.7.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nagios:nagios_xi::::::::	before 5.7.3	Vulnerable	Nagios

cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:* Versions before 5.7.3 Vulnerable ·Nagios

Remediation

Fix · CNA XI (Nagios) Fixed in 5.7.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-10-30
Nagios XI 5.7.3
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2020-19003 Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh ScriptPriority LOW 39
- TI-2020-19001 Nagios XI < 5.7.3 XSS via Manage Users in Admin InterfacePriority LOW 24
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2020-36867
2026-10-03 Alias added: GHSA-3qxh-pr59-jwh7

References

Patch 1

https://www.nagios.com/changelog/nagios-xi/

TI-2021-07545 Nagios XI version xi-5.7.5 is affected by OS command injection. KEVCVSS 3.1HIGH 8.8
TI-2021-07544 Nagios XI version xi-5.7.5 is affected by OS command injection. KEVCVSS 3.1HIGH 8.8
TI-2021-07543 Nagios XI version xi-5.7.5 is affected by OS command injection. KEVCVSS 3.1HIGH 8.8
TI-2019-11993 Nagios XI before 5.6.6 allows remote command execution as root. KEVCVSS 3.1HIGH 8.8
TI-2023-26027 Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE)… CVSS 3.1CRITICAL 9.8
TI-2018-11196 Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute… CVSS 3.0CRITICAL 9.8

See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences