{"id":"CVE-2026-120495","kind":"vulnerability","aliases":["CVE-2026-120495"],"related":[],"title":"Checkmk: path traversal in Robotmk test service lets attackers run code","description":"Path traversal in the Synthetic Monitoring \"Robotmk\" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.","summary":"Checkmk's Synthetic Monitoring Robotmk test service has a path traversal flaw. An attacker who controls the agent output of a monitored host can write a crafted robot output that sets the location of the generated HTML log, leading to code execution as the Checkmk site user.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Checkmk","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["checkmk","robotmk","self-hosted","vendor"],"not_affected_if":["fixed-version","robotmk-unused"],"how_to_check":"- Check the installed Checkmk version against the fixed releases listed in the sources.\n- Check whether the Synthetic Monitoring Robotmk service is in use on the site.","fix":"- Move to `2.5.0p19` on the 2.5.0 line.\n- Move to `2.4.0p40` on the 2.4.0 line.\n- 2.3.0 is end of life; the sources give no fixed version for it.","status":"open","published_at":"2026-11-11T11:17:13+00:00","first_seen_at":"2026-11-11T11:26:55+00:00","triaged_at":"2026-11-11T11:27:27+00:00","updated_at":"2026-11-11T11:27:27+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-11T11:27:27Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `2.5.0p19` on the 2.5.0 line.\n- Move to `2.4.0p40` on the 2.4.0 line.\n- 2.3.0 is end of life; the sources give no fixed version for it.","reach":"network","title":"Checkmk: path traversal in Robotmk test service lets attackers run code","impact":"high","summary":"Checkmk's Synthetic Monitoring Robotmk test service has a path traversal flaw. An attacker who controls the agent output of a monitored host can write a crafted robot output that sets the location of the generated HTML log, leading to code execution as the Checkmk site user.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["checkmk","self-hosted","robotmk"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Code runs as the Checkmk site user on the monitoring server.","analyst_note":"Confirm the fixed-version ranges and whether 2.3.0 has a patch, using the NVD entry and Checkmk's advisory.","how_to_check":"- Check the installed Checkmk version against the fixed releases listed in the sources.\n- Check whether the Synthetic Monitoring Robotmk service is in use on the site.\n- unknown for other checks: the sources do not say.","plain_action":"","product_name":"Checkmk","needs_analyst":true,"not_affected_if":["fixed-version","robotmk-unused"],"who_is_affected":"Teams running Checkmk with Synthetic Monitoring Robotmk checks, where monitored hosts feed agent output to the server. The flaw needs an attacker who controls that agent output. Sites not using Robotmk and sites already on the fixed versions can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000789,"input_tokens":4605,"output_tokens":657,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120495':14A,17A '-2026':13A,16A '2.3.0':88C '2.4.0':85C '2.5.0':83C 'agent':42B,96C 'allow':90C 'attack':9A,38B,92C 'check':103C 'checkmk':1A,18A,19B,25B,69B,82C 'code':11A,65B,127C 'content':117C 'control':40B,94C 'craft':51B,111C 'cve':12A,15A 'defin':115C 'eol':89C 'execut':66B,128C 'flaw':36B 'generat':60B,122C 'host':23B,47B,101C,107C 'html':61B,123C 'inject':109C 'lead':63B,125C 'let':8A 'locat':57B,119C 'log':62B,124C 'monitor':28B,46B,77C,100C 'output':43B,53B,97C,104C,113C 'p19':84C 'p40':86C 'path':2A,34B,72C 'robot':52B,112C 'robotmk':5A,20B,29B,78C 'run':10A 'self':22B 'self-host':21B 'servic':7A,31B,80C 'set':55B 'site':70B,131C 'synthet':27B,76C 'test':6A,30B,79C 'travers':3A,35B,73C 'user':71B,132C 'vendor':24B 'write':49B","nicknames":[],"mitigations":[],"who_affected":"Teams running Checkmk with Synthetic Monitoring Robotmk checks, where monitored hosts feed agent output to the server. The flaw needs an attacker who controls that agent output. Sites not using Robotmk and sites already on the fixed versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["checkmk"],"ptokens":["checkmk"],"labels":["checkmk","critical","robotmk","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120495':14A,17A '-2026':13A,16A 'attack':9A 'checkmk':1A,18A 'code':11A 'cve':12A,15A 'let':8A 'path':2A 'robotmk':5A 'run':10A 'servic':7A 'test':6A 'travers':3A","search_b":"'agent':42B 'attack':38B 'checkmk':19B,25B,69B 'code':65B 'control':40B 'craft':51B 'execut':66B 'flaw':36B 'generat':60B 'host':23B,47B 'html':61B 'lead':63B 'locat':57B 'log':62B 'monitor':28B,46B 'output':43B,53B 'path':34B 'robot':52B 'robotmk':20B,29B 'self':22B 'self-host':21B 'servic':31B 'set':55B 'site':70B 'synthet':27B 'test':30B 'travers':35B 'user':71B 'vendor':24B 'write':49B","search_c":"'2.3.0':88C '2.4.0':85C '2.5.0':83C 'agent':96C 'allow':90C 'attack':92C 'check':103C 'checkmk':82C 'code':127C 'content':117C 'control':94C 'craft':111C 'defin':115C 'eol':89C 'execut':128C 'generat':122C 'host':101C,107C 'html':123C 'inject':109C 'lead':125C 'locat':119C 'log':124C 'monitor':77C,100C 'output':97C,104C,113C 'p19':84C 'p40':86C 'path':72C 'robot':112C 'robotmk':78C 'servic':80C 'site':131C 'synthet':76C 'test':79C 'travers':73C 'user':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@checkmk.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120495","severity":null,"published_at":"2026-11-11T11:17:13+00:00","modified_at":"2026-11-11T11:17:13+00:00","first_seen_at":"2026-11-11T11:26:55+00:00","fetched_at":"2026-11-11T11:26:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}