High · published November 17, 2025
⚡ An authenticated command injection vulnerability lurks in Nagios Log Server before version 2026R1.0.1, making it a prime target for mischief! 🎭 Think of this as a restaurant where the chef trusts the kitchen staff to order ingredients without checking the menu. If a rogue staff member inputs a wild order, the chef might accidentally whip up something catastrophic that no one asked for! An attacker with access to the 'Global Settings' page can run arbitrary commands on the Log Server host as the 'www-data' user. This means they could potentially manipulate data, access sensitive information, or even take full control of the server—an absolutely devastating scenario.
Think of this as a restaurant where the chef trusts the kitchen staff to order ingredients without checking the menu. If a rogue staff member inputs a wild order, the chef might accidentally whip up something catastrophic that no one asked for! The vulnerability arises from the 'Natural Language Queries' feature, which reads user-controlled settings and executes them in a shell command via shell_exec() without proper input handling. This creates a pathway for attackers to inject malicious commands into the system.
An attacker with access to the 'Global Settings' page can run arbitrary commands on the Log Server host as the 'www-data' user. This means they could potentially manipulate data, access sensitive information, or even take full control of the server—an absolutely devastating scenario. To remediate this, update your Nagios Log Server to version 2026R1.0.1 immediately to close this loophole. Additionally, review your user permissions to limit access to the Global Settings page and consider implementing stricter input validation. You’ve got this! Just follow these steps and you’ll have your server locked down in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| nagios/log_server | < 2026 | 2026 |
| nagios/log_server | all versions | — |