Checkmk up to 2.3.0/2.4.0p39/2.5.0p18 Host Label Synchronization path traversal

Summaryinfo

A vulnerability was found in Checkmk up to 2.3.0/2.4.0p39/2.5.0p18 and classified as very critical. This affects an unknown function of the component Host Label Synchronization. Such manipulation leads to path traversal. This vulnerability is referenced as CVE-2026-118965. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Checkmk up to 2.3.0/2.4.0p39/2.5.0p18 and classified as very critical. Affected by this issue is an unknown code of the component Host Label Synchronization. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code as the central site user.

The advisory is shared for download at checkmk.com. This vulnerability is handled as CVE-2026-118965 since 10/29/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/11/2026). The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 2.4.0p40 or 2.5.0p19 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Checkmk

Version

• 2.0
• 2.1
• 2.2
• 2.3.0
• 2.4.0p39
• 2.5.0p18

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion