Executive brief
Icinga ipl-web is a collection of web components used in PHP projects, specifically within the Icinga Web monitoring platform. A security flaw allows an attacker to trick a user into visiting a malicious website that executes unauthorized code in their browser. This could allow an attacker to perform actions on behalf of the user, potentially compromising monitoring data or system configurations.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Icinga ipl-web due to improper neutralization of input during web page generation (CWE-79). The flaw is triggered by malformed search requests processed by the CompatController. An attacker can exploit this by inducing a high-privileged user to visit a specially crafted URL. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's session, potentially leading to full compromise of the Icinga Web interface. The issue is patched in versions 0.10.3 and 0.13.1 by ensuring correct Content-Type headers (application/vnd.icinga+multipart) are set during dispatch.
Affected products
- Icinga ipl-web < 0.10.3, < 0.13.1
Timeline
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-04-23: patched: Version 0.13.1 released
- 2026-05-08: disclosed: CVE-2026-42224 published
- 2026-06-01: patched: Version 0.10.3 released