CVE-2026-118965

waiting for further signals

EUVD-2026-123353 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Checkmk GmbH Checkmk >= 2.5.0, < 2.5.0p19; >= 2.4.0, < 2.4.0p40; 2.3.0

fixed in 2.5.0p19, 2.4.0p40

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ETK-2026-4162, permanent identifier

cvss9.4cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

53msince last run

38mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+1h10m

+2h

+4h

+6h

+8h

+10h

+12h

description

Checkmk host label synchronization is affected by a path traversal flaw in distributed monitoring deployments. An attacker controlling a remote site can write arbitrary files on the central site and execute code as the central site user. Affected deployments require a remote site under attacker control.

mitigation

Upgrade Checkmk to 2.5.0p19 or 2.4.0p40. Replace or retire 2.3.0 deployments, and restrict control of remote sites until upgrades are complete.

fixed in 2.5.0p19, 2.4.0p40

check

exploit

automation

contextual

auth required

yes, low privileges

EPSS

–

agent run time

38m

cve.org record, t = 0

2026-11-11 10:48Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-11 10:48Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-118965

this entry in the feed

GET /api/v1/feed/CVE-2026-118965

{
  "etk_id": "ETK-2026-4162",
  "cve_id": "CVE-2026-118965",
  "display_id": "CVE-2026-118965",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-123353",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in Checkmk host label synchronization",
  "summary": "Checkmk host label synchronization is affected by a path traversal flaw in distributed monitoring deployments. An attacker controlling a remote site can write arbitrary files on the central site and execute code as the central site user. Affected deployments require a remote site under attacker control.",
  "mitigation": "Upgrade Checkmk to 2.5.0p19 or 2.4.0p40. Replace or retire 2.3.0 deployments, and restrict control of remote sites until upgrades are complete.",
  "vendor": "Checkmk GmbH",
  "product": "Checkmk",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.5.0, < 2.5.0p19",
        ">= 2.4.0, < 2.4.0p40",
        "2.3.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.5.0p19",
        "2.4.0p40"
      ],
      "package_name": "Checkmk",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 9.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 37.64662031666667,
  "t0_at": "2026-11-11T10:48:05.582000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T10:48:05.582000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T10:48:05.582000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-118965"
    }
  }
}

published 2026-11-11 11:19Z
last change 2026-11-11 12:22Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.