CVE-2024-14002

Published: Oct 30, 2025Modified: Jun 17, 2026

7.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.

Affected (8)

Products: Nagios: Nagios Xi

Nagios

1 product

Nagios Xi

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Nagios Nagios Xi	Before 2024
Nagios Nagios Xi	Version 2024 r1.0.1
Nagios Nagios Xi	Version 2024 r1.0.2
Nagios Nagios Xi	Version 2024 r1.1.1
Nagios Nagios Xi	Version 2024 r1.1.2
Nagios Nagios Xi	Version 2024 r1.1.3
Nagios Nagios Xi	Version 2024 r1.1
Nagios Nagios Xi	Version 2024 r1

Related CWEs

CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

References (3)

https://www.nagios.com/changelog/nagios-xi/

Source: disclosure@vulncheck.com

Release Notes

https://www.nagios.com/products/security/#nagios-xi

Source: disclosure@vulncheck.com

Vendor Advisory

https://www.vulncheck.com/advisories/nagios-xi-authenticated-local-file-inclusion-via-nagvis

Source: disclosure@vulncheck.com

Third Party Advisory

Timeline

No history available yet.