CVE-2026-120495 Arbitrary file write and code execution via crafted Synthetic Monitoring agent data
CriticalCVSS 9.4
- Published
- Updated
- Exploit status
- No public exploit known
Description
Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Checkmk GmbH Checkmk | >= 2.5.0, < 2.5.0p19 | 2.5.0p19 |
| Checkmk GmbH Checkmk | >= 2.4.0, < 2.4.0p40 | 2.4.0p40 |
| Checkmk GmbH Checkmk | = 2.3.0 | No fix listed |
References
- checkmk.com vendor-advisory