CHECKMK · CVE-2026-120495 · Vendor
NO FIX YET · SEE WHAT TO DO
Checkmk's Synthetic Monitoring Robotmk test service has a path traversal flaw. An attacker who controls the agent output of a monitored host can write a crafted robot output that sets the location of the generated HTML log, leading to code execution as the Checkmk site user.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Checkmk with Synthetic Monitoring Robotmk checks, where monitored hosts feed agent output to the server. The flaw needs an attacker who controls that agent output. Sites not using Robotmk and sites already on the fixed versions can skip it.
Not affected if fixed-version, robotmk-unused
Who cares checkmk, robotmk, self-hosted
2.5.0p19 on the 2.5.0 line.2.4.0p40 on the 2.4.0 line.Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.