Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1.0 (EOL) allows authenticated attackers to define the storage location of report file pairs beyond their intended root directory.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://checkmk.com/werk/17984 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.1 · checkmkNVD modified 2026-10-19 16:10
Affected (CPE criteria) 94
cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p1:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p10:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p11:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p12:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p13:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p14:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p16:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p17:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p18:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p19:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p21:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p22:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p23:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p24:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p25:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p26:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p27:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p28:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p29:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p3:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p30:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p31:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p32:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p33:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p34:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p35:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p36:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p37:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p38:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p39:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p4:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p40:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p41:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p42:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p43:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p44:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p45:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p5:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.2.0:p6:*:*:*:*:*:*- and 54 more
References 3
- https://checkmk.com/werk/17984 Vendor Advisory
- https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250730-01_Checkmk_Path_Traversal Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Oct/7 Exploit, Mailing List, Third Party Advisory