CVE-2025-49643

Name of the Vulnerable Software and Affected Versions Zabbix (affected versions not specified)

Description An authenticated Zabbix user, including a Guest user, can cause a disproportionate CPU load on the webserver. This is achieved by sending specially crafted parameters to the /imgstore.php API endpoint, potentially leading to a denial of service. The vulnerable parameter is not explicitly identified, but it is part of the request sent to the /imgstore.php endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.