CVE-2021-40344

What it actually does

This vulnerability allows an authenticated Nagios XI administrator to upload a file with an arbitrary extension through the Admin panel Custom Includes feature when the uploaded content presents an image MIME type. Because the application does not sufficiently enforce safe file extensions or prevent executable content from being placed in a web-accessible location, a crafted PHP file can be uploaded and then requested through the web server. Successful exploitation results in remote command execution with the privileges of the Nagios XI web application/web server process, which can allow access to monitoring configuration, credentials, host/service data, command execution facilities, and further local privilege escalation depending on system hardening.

Why it matters to the business

An attacker who obtains Nagios XI administrator access can turn the monitoring server into an execution foothold. Because Nagios XI commonly has broad visibility into infrastructure, credentials, alerting workflows, and operational dependencies, compromise can disrupt monitoring, hide outages or intrusions, expose sensitive infrastructure information, and support lateral movement. The high EPSS score and public exploit availability increase urgency even though the flaw requires high privileges and is not currently listed in CISA KEV.

How an attack unfolds

An attacker first needs Nagios XI administrator-level access, typically through stolen credentials, session theft, phishing, credential reuse, or prior compromise of an administrative account. The attacker then navigates to the Admin panel Custom Includes functionality and uploads a crafted PHP web shell or command-execution script while setting the request MIME type to an image type such as image/png or image/jpeg. Because the vulnerable upload validation relies on MIME type rather than safely restricting executable extensions and storage behavior, the PHP file is accepted. The attacker then directly requests the uploaded PHP file through the Nagios XI web interface and supplies command parameters to execute operating system commands. From there, the attacker may enumerate configuration files, harvest credentials, modify monitoring behavior, deploy persistence, download additional tooling, or use the monitoring system’s privileged network position to pivot to other systems.

How to fix it

Upgrade Nagios XI to a vendor-supported version that contains the upload validation fix for this issue. No exact fixed version was provided in the input, so use the latest available Nagios XI release from the vendor and confirm the vendor advisory/release notes for CVE-2021-40344 remediation. Remove any unnecessary Custom Includes content and delete unexpected executable files from Nagios XI web-accessible directories. As compensating controls, restrict Nagios XI administrative access to trusted management networks or VPNs, enforce MFA for administrators, minimize the number of administrator accounts, disable or tightly control upload/customization features where possible, and configure the web server to prevent execution of PHP or other scripts from upload/include directories. Review file permissions so the web server cannot write executable content into locations that are later interpreted by PHP.

How to confirm the fix worked

Confirm the installed Nagios XI version is newer than the vulnerable release and is vendor-supported. Validate that the Custom Includes upload workflow rejects files with executable extensions such as .php, .phtml, .phar, .php5, and similar variants regardless of MIME type or file content. Confirm uploaded custom include files are stored outside executable web paths or are served as static content only. Review web server configuration to ensure PHP execution is disabled in upload/include directories. Search the Nagios XI installation tree and web root for unexpected PHP files, recent file modifications, and executable content placed by the web server user. Perform a controlled test in a non-production environment or during an approved validation window to ensure a PHP file masquerading as an image cannot be uploaded or executed.

Typical attack path

1. Obtain or compromise a Nagios XI administrator account.
2. Authenticate to the Nagios XI web interface.
3. Open the Admin panel Custom Includes upload functionality.
4. Upload a PHP web shell or command-execution script while presenting an allowed image MIME type.
5. Locate the uploaded file in a web-accessible path.
6. Send HTTP requests to the uploaded PHP file to execute commands.
7. Enumerate Nagios XI configuration, credentials, monitored assets, and local system context.
8. Use the compromised monitoring server for persistence, data theft, alert suppression, or lateral movement.

How to detect it

To determine whether exploitation already occurred, review web server access and error logs, Nagios XI audit/admin logs, authentication logs, and filesystem metadata for upload and execution activity. Focus on authenticated administrator sessions that accessed Custom Includes functionality, especially POST requests with image MIME types and filenames ending in PHP-related extensions. Look for subsequent requests to newly uploaded PHP files, particularly requests containing command-style parameters such as cmd=, exec=, command=, shell=, or system=. On the host, inspect Nagios XI web directories and custom include locations for PHP files with recent modification times, files owned by the web server user, or files containing functions such as system(), shell_exec(), passthru(), exec(), eval(), base64_decode(), or preg_replace with executable behavior. Review process accounting, EDR telemetry, auditd, and syslog for the web server process spawning command interpreters or network utilities. Also investigate any monitoring configuration changes, disabled checks, deleted alerts, or credential access following suspicious administrator logins.

• /nagiosxi/admin/custom-includes.php
• custom-includes.php
• Content-Type: image/png
• Content-Type: image/jpeg
• filename="*.php"
• filename="*.phtml"
• filename="*.phar"
• cmd=
• exec=
• command=
• shell=
• system=
• shell_exec(
• passthru(
• base64_decode(
• eval(
• /bin/sh -c
• /bin/bash -c
• httpd
• apache2
• www-data
• apache

What your security team should do

• Prioritize upgrade or vendor patch validation because public exploit code is available and EPSS is high.
• Audit all Nagios XI administrator accounts, remove unused accounts, rotate credentials, and enforce MFA.
• Restrict administrative access to Nagios XI by network controls, VPN, SSO policy, or privileged access management.
• Search web roots and Nagios XI custom include directories for unexpected executable files and recently modified artifacts.
• Review Apache/httpd access logs for POST requests to Custom Includes administration pages followed by GET requests to uploaded PHP files.
• Hunt for web server child processes spawning shells or command-line tools such as sh, bash, curl, wget, nc, python, perl, or php.
• Review Nagios XI audit/admin logs for suspicious uploads, administrator logins from unusual sources, and changes to monitoring configuration.
• If exploitation is suspected, isolate the Nagios XI host, preserve logs and uploaded files, rotate secrets stored or used by Nagios XI, and examine monitored-system trust relationships.