Checkmk: Path traversal in Robotmk HTML log service allows code execution
Summary
Checkmk versions before 2.5.0p19 and 2.4.0p40 (and 2.3.0, which is end-of-life) contain a path traversal flaw in the Robotmk Synthetic Monitoring test service. An attacker who controls the agent output of a monitored host can place a crafted HTML log file at an arbitrary location with user-defined content. This leads to code execution as the Checkmk site user. The attacker first needs to compromise a monitored host with root privileges, and automatic service discovery must be enabled or a monitoring admin must confirm the Robotmk services.
Affected
- Checkmk 2.5.0 before 2.5.0p19
- Checkmk 2.4.0 before 2.4.0p40
- Checkmk 2.3.0 (end-of-life). The vendor Werk lists it as affected; the CNA record marks 2.3.0 as unaffected by default. Treat it as affected.
Fixed in
- Checkmk 2.5.0p19
- Checkmk 2.4.0p40
- Checkmk 2.3.0: no fix, end-of-life
Workaround
- Unknown. The vendor does not describe a workaround beyond the fixed releases.
- Restrict who can add or modify monitored hosts and Robotmk services.
- Review agent output and plug-ins from hosts that are not fully trusted.
Exploitation
- No evidence of active exploitation known at the time of writing.
- No public proof of concept found.
- Not listed in CISA KEV as far as confirmed.
- NVD status is Deferred; the CVSS 9.4 score is the CNA's rating.
Our recommendation
- Identify all Checkmk instances and their versions, including 2.3.0.
- Upgrade to 2.5.0p19 or 2.4.0p40 as a priority.
- Replace any 2.3.0 instance with a supported release.
- Apply the same releases to the same-day fixes CVE-2026-118965 and CVE-2026-121374.
- Limit root access on monitored hosts and disable automatic discovery of Robotmk services where not needed.
- Monitor agent plug-ins and spool files for unexpected changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Checkmk Werk #22624 checkmk.com
- OffSeq Radar: CVE-2026-120495 radar.offseq.com
- OffSeq Radar: CVE-2026-121374 radar.offseq.com
- OffSeq Radar: CVE-2026-118965 radar.offseq.com
- Checkmk Werk #19238 (earlier HTML log XSS fix) checkmk.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:22.
Original description (NVD)
Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.