CVE-2026-120495: Arbitrary file write and code execution via crafted Synthetic Monitoring agent data

Q: Which environments are exposed to this issue?

Checkmk versions earlier than 2.5.0p19 and 2.4.0p40 are affected, as is Checkmk 2.3.0, which is end of life. The issue is in the Synthetic Monitoring Robotmk test service.

Q: What does an attacker need to exploit it?

The attacker must be able to control the agent output or check output for a monitored host. They can use crafted Robotmk output to control the location and contents of a generated HTML log.

Q: What is the likely impact of successful exploitation?

Successful exploitation can cause arbitrary file writes through path traversal and lead to code execution as the Checkmk site user. The supplied severity data rates the issue critical with a 9.4 score.

Published Nov 11, 2026

Updated

Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.

Affected Software

1 affected component

Checkmk Checkmk<2.5.0p19, <2.4.0p40, =2.3.0

Event History

Nov 11, 2026

CVE Published

via MITRE·10:46 AM

Data Sourced

via MITRE·10:46 AM

DescriptionWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which environments are exposed to this issue?

Checkmk versions earlier than 2.5.0p19 and 2.4.0p40 are affected, as is Checkmk 2.3.0, which is end of life. The issue is in the Synthetic Monitoring Robotmk test service.

What does an attacker need to exploit it?

The attacker must be able to control the agent output or check output for a monitored host. They can use crafted Robotmk output to control the location and contents of a generated HTML log.

What is the likely impact of successful exploitation?

Successful exploitation can cause arbitrary file writes through path traversal and lead to code execution as the Checkmk site user. The supplied severity data rates the issue critical with a 9.4 score.

CVE-2026-120495: Arbitrary file write and code execution via crafted Synthetic Monitoring agent data

Affected Software

Event History

Frequently Asked Questions

Which environments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which environments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?