Your message dated Fri, 09 Oct 2026 11:39:28 +0000
with message-id <[email protected]>
and subject line Bug#1121618: fixed in nagios4 4.5.14+ds-1
has caused the Debian Bug report #1121618,
regarding nagios4: config.inc.php should be installed into /etc/nagios4 not
/usr/share/nagios4/htdocs/
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1121618: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121618
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nagios4
Version: 4.4.6-4.1
Severity: normal
Dear Maintainer,
config.inc.php is currently installed as
/usr/share/nagios4/htdocs/config.inc.php
This prevents the local system administrator from correctly overriding paths.
Even if you override them in
- /etc/nagios4/nagios.cfg
- /etc/nagios4/cgi.cfg
They will be inconsistent with config.inc.php, and the web CGI scripts will
continue to output the hard-coded paths.
As you correctly noted in README.Debian, as of version 4.4.6 nagios hardcodes
cgiurl in various places so even this (symlinking config.inc.php) is not 100%
effective. HOWEVER upstream was in the process of fixing this, and it is now
fixed in the current upstream version 4.5.10, so that config.inc.php is the
only place that hardcodes @cgiurl@ and everything else reads it from there.
So updating to the latest upstream version (#1052527) AS WELL AS fixing the
subject of this bug report, will allow you to get rid of the overly complex
instructions and caveats in README.Debian for running nagios4-cgi under a
non-default web path. The instructions will then be simply to edit:
- /etc/nagios4/nagios.cfg
- /etc/nagios4/cgi.cfg
- /etc/nagios4/config.inc.php
As it stands, the current situation in version 4.4.6 is actually not that
complicated, more simple than README.Debian makes out. The only hardcoded path
is /cgi-bin/nagios4 for the CGI scripts, everything else can be fixed via
url_html_path in cgi.cfg. So a working web config would only need to alias
these paths (plus stylesheets). An example lighttpd config is here:
~~~~
alias.url += (
"/cgi-bin/nagios4/" => "/usr/lib/cgi-bin/nagios4/",
"/nagios4/stylesheets/" => "/etc/nagios4/stylesheets/",
"/nagios4/" => "/usr/share/nagios4/htdocs/",
)
$HTTP["url"] =~ "^/nagios4/|^/cgi-bin/nagios4/" {
auth.backend = "htpasswd"
auth.backend.htpasswd.userfile = "/etc/nagios4/htdigest.users"
auth.require = ( "" => ( "method" => "basic",
"realm" => "Nagios",
"require" => "valid-user" ) )
fastcgi.server += ( ".php" =>
((
"socket" => "/run/php/php-fpm.sock",
"broken-scriptfilename" => "enable"
))
)
cgi.assign = ( ".cgi" => "" )
}
~~~~
Note the necessity of making the htpasswd config work for both /nagios4 (or
whatever url_html_path is) as well as the hard-coded /cgi-bin/nagios4.
After this bug and #1052527 are complete, the local administrator will have the
option to easily put everything underneath any path of their choosing, e.g.:
~~~~
alias.url += (
"/CUSTOMPATH/cgi-bin/" => "/usr/lib/cgi-bin/nagios4/",
"/CUSTOMPATH/stylesheets/" => "/etc/nagios4/stylesheets/",
"/CUSTOMPATH/" => "/usr/share/nagios4/htdocs/",
)
$HTTP["url"] =^ "/CUSTOMPATH/" {
auth.backend = "htpasswd"
auth.backend.htpasswd.userfile = "/etc/nagios4/htdigest.users"
auth.require = ( "" => ( "method" => "basic",
"realm" => "Nagios",
"require" => "valid-user" ) )
fastcgi.server += ( ".php" =>
((
"socket" => "/run/php/php-fpm.sock",
"broken-scriptfilename" => "enable"
))
)
cgi.assign = ( ".cgi" => "" )
}
~~~~
alongside the relevant path config changes in /etc/nagios4, as described above.
Best,
X
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable-debug'), (500,
'testing-debug'), (500, 'stable-security'), (300, 'unstable'), (200,
'experimental'), (1, 'experimental-debug')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.17.8+deb14-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages nagios4 depends on:
ii nagios4-cgi 4.4.6-4.1
ii nagios4-common 4.4.6-4.1
ii nagios4-core 4.4.6-4.1
nagios4 recommends no packages.
Versions of packages nagios4 suggests:
pn nagios-nrpe-plugin <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: nagios4
Source-Version: 4.5.14+ds-1
Done: Russell Stuart <[email protected]>
We believe that the bug you reported is fixed in the latest version of
nagios4, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Russell Stuart <[email protected]> (supplier of updated nagios4
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 19:35:18 +1000
Source: nagios4
Architecture: source
Version: 4.5.14+ds-1
Distribution: unstable
Urgency: high
Maintainer: Russell Stuart <[email protected]>
Changed-By: Russell Stuart <[email protected]>
Closes: 1063514 1119147 1121618 1123716 1144495 1145888
Changes:
nagios4 (4.5.14+ds-1) unstable; urgency=high
.
* New upstream release (4.5.14).
* Fixes reflected XSS in cmd.cgi via NagFormId (CVE-2026-48550),
CSRF protection bypass via a self-supplied double-submit cookie
(CVE-2026-48551), DOM XSS in jsonquery.js (CVE-2026-48552),
authenticated RCE via custom-variable macro injection
(CVE-2026-48553) and authenticated RCE via NOTIFICATION-family
macro substitution (CVE-2026-48554). Closes: #1144495.
* Fixes the CSRF cookie bypass when no Cookie header is sent
(CVE-2026-48549). Closes: #1145888.
* The daemon no longer contacts api.nagios.org by default, so it no
longer segfaults parsing the reply. Closes: #1119147.
* Upstream 4.5.10 fixed the 64-bit time_t printf in lib/worker.c that
made every check time land in 1970 on armhf. Closes: #1123716.
* Upstream 4.5.4 fixed the View Trends and View Alert Histogram links.
Closes: #1063514.
* Ship config.inc.php as a conffile in /etc/nagios4, symlinked into the
htdocs directory, so paths can be overridden locally. Closes: #1121618.
* Make apache2 read /etc/nagios4/apache2.conf.
* debian/watch: track upstream's GitHub tags, since SourceForge has
carried no release since 4.5.9.
* Rename 90_turn-off-use-authentication.path to .patch.
* debian/rules: remove base/wpres-phash.h, include/Makefile and
include/ignored_config.h in clean, so a second build in the same
tree does not abort on unexpected upstream changes.
Checksums-Sha1:
5ce88dfad6b8cff59c47b36fff45143c83094b95 2023 nagios4_4.5.14+ds-1.dsc
62b1ccea513d50cdd4b2f71216226d17da80ba6c 1802612 nagios4_4.5.14+ds.orig.tar.xz
c47ee33c2b95e6c519e72ed7cca16da88688dc94 23860
nagios4_4.5.14+ds-1.debian.tar.xz
51abf1ad6bc6abce51ac88b05853b80c144756ed 10470
nagios4_4.5.14+ds-1_amd64.buildinfo
Checksums-Sha256:
d1a6916b89267b1f13b9b25e224323d8dd6651bcb615f39f9b55b89ddad736bb 2023
nagios4_4.5.14+ds-1.dsc
de0633bfe18ff66cf34d00a1534a832620140b2b23802feeefab16014d55544d 1802612
nagios4_4.5.14+ds.orig.tar.xz
4f8a19055a2b4071e9e7cc8fd6fbe5c21072a10774905bd9a0b5a1eab9b693a5 23860
nagios4_4.5.14+ds-1.debian.tar.xz
95b21b380107b1eaf6752af6f83f139b5a6067377ba83b75ab70c7b5e3eb80b5 10470
nagios4_4.5.14+ds-1_amd64.buildinfo
Files:
d97f4df47921da61f67d659fd82d5955 2023 net optional nagios4_4.5.14+ds-1.dsc
de659d5488dfb0084e0bbd21be4d1a94 1802612 net optional
nagios4_4.5.14+ds.orig.tar.xz
35d4f60e430d52a29e24e2250c1874a0 23860 net optional
nagios4_4.5.14+ds-1.debian.tar.xz
4e36dc84b5e8467ddc32f777a7c8e88b 10470 net optional
nagios4_4.5.14+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZqiOeH6lCkTWvjmorNSfiF5UUm4FAmrIy1sACgkQrNSfiF5U
Um5k8A//eYOSHCaksdSnnslTzdOKnaYFmEkxVt13Nq6TJuUu0o9rnJSajcPS/ykh
rrZsTNEmxMujsOqpaq/uZSpD7HAftqHVzrmHkeFc+MDSjedgoSi1FawuokisWtmb
brZAj6CCVRpSbt1ShCiqvBLHpEUiachSDukFrb8satUs4aOfRmDQTVZUyDWU9q4u
VIg8BkQgHBpIVfYRms9ncrOBr4IP7yScN4+7quJXexVVqdzk4U6ClW5bpi7rTcFn
F/DPQnTiTPRwSO8CDUApExZFrhp56wfKTwJnVN95iqcVcMtq5GERiTFS3xy/uTwR
5kh9adgAeoUuWjByJrVNq41vpr7KE5hQniUhOLvK8yyl56E8apP68VUVDZklOlIr
WvwQCm+ZcTtHxpLr6wj0JelOwTnGKi7e6R7JlYI5aA1RleIrZiQ2Av4cBcBpv5lZ
8mD2VOuVglS+2Q/SxDw5dHZGaVSeM5yUPkxgu3tSGOjiwmmaNci5slvaWL9Nglb5
qdtAy6+yZ6Uf15aZ19wR3yX/66BJndIH1mDkKScMRg2iUYmYKvoh6+bd8R/rQe2N
Zxwe7ypgQwKkkSMQsU/jJOBDBHmR+Jd88ytxjmiqE0LidM1eVqMVW87+wbt2EoTU
ewK0lJM2Gv/Mdo1DyflcI8h8vb3uG9hzH8Ddalt8ck2HTq52+QU=
=0RPa
-----END PGP SIGNATURE-----
pgpt2ZQfv704F.pgp
Description: PGP signature
--- End Message ---
