CVE-2025-67254

Deeper analysis

NagiosXI version 2026R1.0.1 build 1762361101 contains a directory traversal vulnerability (CWE-22) in the /admin/coreconfigsnapshots.php endpoint. The flaw is rated 7.5 under CVSS 3.1 with network attack vector, low complexity, and no authentication or user interaction required, resulting in high impact to confidentiality while leaving integrity and availability unaffected.

An unauthenticated remote attacker can supply crafted path traversal sequences through the affected endpoint to read arbitrary files on the underlying system. Successful exploitation grants access to sensitive configuration data, credentials, or other restricted content stored on the NagiosXI host without requiring prior privileges.

The provided references include a public GitHub repository containing technical details on the issue and the official Nagios project site, though no vendor advisory text or patch information is included in the available data. The EPSS score reached a peak of 0.0480 after disclosure, reflecting a measurable increase in exploitation interest from its initial low baseline.