CVE-2026-48550

NameCVE-2026-48550
DescriptionNagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4832-1, DSA-6556-1
Debian Bugs1144495

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nagios4 (PTS)bookworm4.4.6-4+deb12u1vulnerable
bookworm (security)4.4.6-4+deb12u2fixed
trixie4.4.6-4.1+deb13u1vulnerable
trixie (security)4.4.6-4.1+deb13u2fixed
sid4.5.14+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nagios4sourcebookworm4.4.6-4+deb12u2DLA-4832-1
nagios4sourcetrixie4.4.6-4.1+deb13u2DSA-6556-1
nagios4source(unstable)4.5.14+ds-11144495

Notes

Fixed by: https://github.com/NagiosEnterprises/nagioscore/commit/acd2365e816dda4a8dce61709f8d3a3b4ab04a6f (nagios-4.5.14)
Search for package or bug name: Reporting problems