Path Traversal in Checkmk's Synthetic Monitoring Service
CVE-2026-120495

9.4CRITICAL

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
11 November 2026

What is CVE-2026-120495?

A vulnerability exists in Checkmk's Synthetic Monitoring 'Robotmk' test service, which allows an attacker to exploit path traversal mechanisms. By manipulating the agent output of a monitored host, an attacker can inject specially crafted data that controls the contents and location of the generated HTML log files. This can lead to unauthorized code execution within the context of the site user, potentially compromising system integrity and security.

Affected Version(s)

Checkmk 2.5.0 < 2.5.0p19

Checkmk 2.4.0 < 2.4.0p40

Checkmk 2.3.0

References

https://checkmk.com/werk/22624
vendor-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.