Werk #22624: Code execution through Robotmk HTML log test service
| Component | Checks & agents | ||||||
| Title | Code execution through Robotmk HTML log test service | ||||||
| Date | Nov 2, 2026 | ||||||
| Level | Prominent Change | ||||||
| Class | Security Fix | ||||||
| Compatibility | Compatible - no manual interaction needed | ||||||
| Checkmk versions & editions |
|
The Robotmk test service allows users to define a test case name in the agent data which is used to create the folder for the HTML log file. The final path generated was not sufficiently validated allowing for path traversal of an HTML file whose content is user defined, allowing for arbitrary code execution.
As of this werk, the log files will no longer be created outside of ~/var/robotmk/html_logs and
an UNKNOWN status will be displayed in the service summary when this occurs.
Who is Affected
To exploit the vulnerability, a host running a Checkmk agent has to be compromised to add crafted agent output. For example by creating a malicious agent plug-in or spool file. This usually needs root privileges on a host monitored with Checkmk. Additionally, automatic service discovery for the host in monitoring has to be enabled or a monitoring admin on the Checkmk server has to confirm adding Robotmk services manually.
Affected Checkmk Versions
- 2.5.0
- 2.4.0
- 2.3.0 (EOL)
Vulnerability Management
We have rated the issue with a CVSS Score of 9.4 CRITICAL
(CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and assigned CVE-2026-120495.