Executive brief
Zabbix Maps is a visualization feature used to display infrastructure topology and system health. An authenticated attacker can inject malicious HTML through URL parameters, which is then stored and displayed to other users who view the affected map, potentially leading to session hijacking or credential theft.
Technical details
A prototype pollution vulnerability exists in the searchParamsToObject() function that processes URL parameters without filtering dangerous properties like __proto__. When combined with jQuery's unsafe element creation, this allows traversal of the prototype chain. An authenticated Zabbix user with access to the Maps page can craft a malicious URL containing injected HTML, which is stored in the database and executed in the browsers of all users viewing the affected map. The vulnerability requires user authentication and a user interaction (viewing the malicious map), but results in persistent XSS execution. Patches are available in Zabbix 6.0.46, 7.0.25, and 7.4.9.
Affected products
- Zabbix Zabbix 6.0.44-6.0.45, 7.0.22-7.0.24, 7.4.6-7.4.8
Timeline
- 2026-08-18: disclosed
- 2026-08-18: patched: Fixed in versions 6.0.46, 7.0.25, and 7.4.9