Path Traversal Vulnerability in Checkmk by Tribe29
CVE-2026-118965

9.4CRITICAL

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
11 November 2026

What is CVE-2026-118965?

A path traversal vulnerability exists in Checkmk, affecting versions prior to 2.5.0p19 and 2.4.0p40, along with the end-of-life version 2.3.0. This flaw allows an attacker controlling a remote site in a distributed monitoring setup to write arbitrary files on the central site. Exploiting this vulnerability could lead to the execution of unauthorized code under the privileges of the central site user, thereby compromising the integrity of the monitoring environment.

Affected Version(s)

Checkmk 2.5.0 < 2.5.0p19

Checkmk 2.4.0 < 2.4.0p40

Checkmk 2.3.0

References

https://checkmk.com/werk/22120
vendor-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.