CVE-2026-23920

Katalog CVE

CVSS 8.8 · High EPSS 0,30%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada zabbix. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

Rincian

Terbit di NVD

24 Maret 2026

Terakhir diubah

10 September 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.zabbix.com/browse/ZBX-27639 advisory vendor