Werk #22120: Code execution through compromised remote site

Component

User interface

Title

Code execution through compromised remote site

Date

Oct 29, 2026

Level

Prominent Change

Class

Security Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

3.0.0b1 Not yet released	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p19	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p40	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

To update host labels the central site is querying the remote sites for discovered host labels. The response is then written to disk. The target filename was not sanitized, therefore a malicious remote site was able to write arbitrary files on the central site leading to code execution.

With this Werk the filenames are properly checked.

Who is Affected

Every setup with potentially untrusted remote sites is affected.

Affected Checkmk Versions

2.5.0
2.4.0
2.3.0 (EOL)

Vulnerability Management

We have rated the issue with a CVSS Score of 9.4 CRITICAL (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and assigned CVE-2026-118965.

This was reported via our security disclosure.

To the list of all Werks