CVE-2021-40345

An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.

• CWE-77

• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXTRelease Notes, Vendor Advisory
• https://github.com/ArianeBlow/NagiosXI-EmersonFI/blob/main/README.mdExploit, Third Party Advisory
• https://synacktiv.comNot Applicable
• https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdfExploit, Third Party Advisory
• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXTRelease Notes, Vendor Advisory
• https://github.com/ArianeBlow/NagiosXI-EmersonFI/blob/main/README.mdExploit, Third Party Advisory
• https://synacktiv.comNot Applicable
• https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdfExploit, Third Party Advisory

Published

Oct 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4034A local privilege escalation vulnerability was found on polk…7.8
• CVE-2021-40340Information Exposure vulnerability in Hitachi Energy LinkOne…7.5
• CVE-2021-40341DES cipher, which has inadequate encryption strength, is use…5.5
• CVE-2021-40342 In the DES implementation, the affected product versions us…9.8
• CVE-2021-40343An issue was discovered in Nagios XI 5.8.5. Insecure file pe…7.8
• CVE-2021-40344An issue was discovered in Nagios XI 5.8.5. In the Custom In…7.2
• CVE-2021-40346An integer overflow exists in HAProxy 2.0 through 2.5 in htx…7.5
• CVE-2021-40347An issue was discovered in views/list.py in GNU Mailman Post…5.4
• CVE-2021-40348Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allow…8.8
• CVE-2021-40349e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal…5.3
• CVE-2021-4035A stored cross site scripting have been identified at the co…4.8
• CVE-2021-40350webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices…9.8