Description
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zabbix | Zabbix | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zabbix | 1:6.0.23+dfsg-1 | — |
| Debian 13 | zabbix | 1:6.0.23+dfsg-1 | — |
| Debian 12 | zabbix | No fix yet | — |
| Debian 11 | zabbix | 1:5.0.44+dfsg-1+deb11u1 | DLA-3909-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | zabbix | No fix yet | — |
Advisories 2
- DLA-3909-1 zabbix - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-1744 Zabbix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 3, 2024