Checkmk: Path traversal in host label synchronization allows code execution
Summary
Checkmk monitoring versions 2.5.0 before 2.5.0p19, 2.4.0 before 2.4.0p40 and 2.3.0 (EOL) contain a path traversal flaw in the synchronization of discovered host labels. A malicious remote site in a distributed monitoring setup can write arbitrary files on the central site and execute code as the central site user. The attacker must control a remote site, so the risk is mainly for setups with untrusted or poorly secured remote sites.
Affected
- Checkmk 2.5.0 before 2.5.0p19
- Checkmk 2.4.0 before 2.4.0p40
- Checkmk 2.3.0 (EOL): listed as affected in the Checkmk werk; the CNA record marks 2.3.0 as unaffected by default. Check the werk for the final status.
Fixed in
- Checkmk 2.5.0p19
- Checkmk 2.4.0p40
- No fix for 2.3.0 (EOL) is known. Unknown whether one will be released.
Workaround
- No vendor workaround is known. Unknown.
- Limit which remote sites can connect to the central site and review their trust.
Exploitation
- No public proof of concept or exploit code is known.
- No evidence of exploitation in the wild is on record, as of the tracker data from 11 Nov 2026.
Our recommendation
- Update Checkmk to 2.5.0p19 or 2.4.0p40.
- Replace any 2.3.0 instance, as it is end-of-life and no fix is known.
- Review which remote sites are connected and restrict trust to known sites.
- Monitor the central site for unexpected file changes until patched.
- Check the Checkmk werk for updated information, as the CVE is very recent.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Checkmk Werk #22120 checkmk.com
- OffSeq Radar: CVE-2026-118965 radar.offseq.com
- Checkmk Forum: Latest posts forum.checkmk.com
- Checkmk Download Archive checkmk.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:22.
Original description (NVD)
Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code as the central site user.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.