Administrator-level code execution via malicious map configuration

Remote code execution in NagVis 1.9.40 through 1.9.41 allows remote authenticated users with administrative privileges to run shell commands. The Map manage action in server/core/ajax_handler.php checks only the .cfg filename extension, not file contents, while MainCfg accepts an absolute authorisation_multisite_file path and loads that file as PHP. Administrative access is required to upload the crafted map and redirect the authorization setting; successful exploitation executes commands as the Checkmk site account.