CVE-2021-40344

An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.

• CWE-434

• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXTRelease Notes, Vendor Advisory
• https://synacktiv.comNot Applicable
• https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdfExploit, Third Party Advisory
• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXTRelease Notes, Vendor Advisory
• https://synacktiv.comNot Applicable
• https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdfExploit, Third Party Advisory

Published

Oct 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40339Configuration vulnerability in Hitachi Energy LinkOne applic…7.5
• CVE-2021-4034A local privilege escalation vulnerability was found on polk…7.8
• CVE-2021-40340Information Exposure vulnerability in Hitachi Energy LinkOne…7.5
• CVE-2021-40341DES cipher, which has inadequate encryption strength, is use…5.5
• CVE-2021-40342 In the DES implementation, the affected product versions us…9.8
• CVE-2021-40343An issue was discovered in Nagios XI 5.8.5. Insecure file pe…7.8
• CVE-2021-40345An issue was discovered in Nagios XI 5.8.5. In the Manage Da…7.2
• CVE-2021-40346An integer overflow exists in HAProxy 2.0 through 2.5 in htx…7.5
• CVE-2021-40347An issue was discovered in views/list.py in GNU Mailman Post…5.4
• CVE-2021-40348Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allow…8.8
• CVE-2021-40349e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal…5.3
• CVE-2021-4035A stored cross site scripting have been identified at the co…4.8