# CVE-2026-120495: Checkmk Robotmk path traversal in HTML log

Source: https://junglewise.ai/threats/cve-2026-120495-path-traversal-in-the-synthetic-monitoring-robotmk-test-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-120495 · Severity: info · Published 2026-11-11

Checkmk is infrastructure monitoring software that tracks the health of servers and applications. The Robotmk test service, which runs synthetic tests, contains a path traversal flaw in HTML log generation that allows an attacker with control over a monitored host's agent output to write files to arbitrary locations and execute code as the monitoring site user. Exploitation requires compromising the monitored host (typically needing root access) and enabling service discovery, making it a high-risk vulnerability for compromised endpoints.

Technologies: [Checkmk](https://junglewise.ai/threats/technologies/checkmk). Vendors: [Checkmk](https://junglewise.ai/threats/vendors/checkmk).

## Quick answers

**Is CVE-2026-120495 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120495 being exploited in the wild.

**How severe is CVE-2026-120495?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Checkmk 2.3.0, 2.4.0 before 2.4.0p40, 2.5.0 before 2.5.0p19.

**Is there a fix for CVE-2026-120495?** Yes: fixed in Checkmk 2.5.0p19, 2.4.0p40. Until then: Restrict access to Checkmk agents and monitoring systems to trusted networks. Disable automatic service discovery for Robotmk if manual control over service addition is feasible, reducing the attack surface for hosts under adversary control. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120495 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-120495?** Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Checkmk 2.5.0p19, 2.4.0p40

Restrict access to Checkmk agents and monitoring systems to trusted networks. Disable automatic service discovery for Robotmk if manual control over service addition is feasible, reducing the attack surface for hosts under adversary control.

## Technical details

A path traversal vulnerability exists in Checkmk's Robotmk test service where user-controlled test case names from agent output are insufficiently validated when constructing the HTML log file path. An attacker who compromises a monitored host can inject a crafted robot output with path traversal sequences to write HTML files with arbitrary content outside the intended ~/var/robotmk/html_logs directory, leading to code execution in the context of the Checkmk site user. The fix validates paths and restricts log file creation to the designated directory.

## Affected products

- Checkmk Checkmk 2.3.0, 2.4.0 before 2.4.0p40, 2.5.0 before 2.5.0p19

## Timeline

- 2026-11-02: disclosed
- 2026-11-11: patched

## References

- [https://checkmk.com/werk/22624](https://checkmk.com/werk/22624)

## Related threats

- [Checkmk Kubernetes special agent argument injection](https://junglewise.ai/threats/cve-2026-121374-argument-injection-in-the-kubernetes-special-agent-in-checkmk-2)
- [Checkmk path traversal in remote site label synchronization](https://junglewise.ai/threats/cve-2026-118965-path-traversal-in-the-discovered-host-label-synchronization-in)
- [Checkmk Windows agent privilege escalation via unprotected data directory](https://junglewise.ai/threats/cve-2026-111573-incorrect-permissions-on-the-checkmk-windows-agent-s-data)
- [Checkmk Jolokia agent password exposure in process list](https://junglewise.ai/threats/cve-2026-103682-invocation-of-the-jolokia-special-agent-with-the-login-password)
- [Checkmk NetApp ONTAP password exposure in process list](https://junglewise.ai/threats/cve-2026-103674-invocation-of-the-netapp-ontap-special-agent-with-the-login)