PT-2026-145117
CVE-2026-120495
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 4.0
9.4
CriticalMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Checkmk versions prior to 2.5.0p19
Checkmk versions prior to 2.4.0p40
Checkmk version 2.3.0
Description
A path traversal issue exists in the Synthetic Monitoring "Robotmk" test service. An attacker who controls the agent output of a monitored host can inject crafted robot output to define the location and contents of the generated HTML log, which can lead to arbitrary file write and code execution as the site user.
Recommendations
Update to version 2.5.0p19 or newer.
Update to version 2.4.0p40 or newer.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾