Cross-Site Scripting Vulnerability in Checkmk by Tribe29

CVE-2025-39663

What is CVE-2025-39663?

A Cross-Site Scripting (XSS) vulnerability exists in Checkmk's distributed monitoring system, which permits a compromised remote site to inject harmful HTML code into service outputs at the central site. This flaw impacts multiple versions of Checkmk prior to 2.4.0p14, including 2.3.0p39, 2.2.0, and the end-of-life 2.1.0. The issue poses a significant risk as it can allow attackers to execute arbitrary scripts in the context of the end user's session.

References