Nagios XI Directory Traversal Vulnerability in coreconfigsnapshots.php

A directory traversal vulnerability has been identified in Nagios XI version 2026R1.0.1 build 1762361101. The issue resides in the file coreconfigsnapshots.php, located in the admin directory. This vulnerability allows attackers to manipulate file paths and potentially access sensitive files on the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files on the server, allowing for information disclosure.

Reproduction

To reproduce this vulnerability, send a GET request to /nagiosxi/admin/coreconfigsnapshots.php. Include the currentdiff parameter with a payload that traverses directories, such as ../../../../../../../../etc/hosts. The archive parameter should be set to 0.