Description
Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code as the central site user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Checkmk | Checkmk | 2.5.0 – < 2.5.0p19, 2.4.0 – < 2.4.0p40, 2.3.0 | 2.5.0p19 |
Advisories 1
- WID-SEC-2026-4453 Checkmk: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Nov 11, 2026
References
- https://checkmk.com/werk/22120 vendor-advisory