PT-2026-47287 · Checkmk Gmbh · Checkmk

Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-8833

Mitre

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another user interacts with the crafted link.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8833

Affected Products

Checkmk

References · 2

• https://checkmk.com/werk/20002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8833 · Security Note