CVE-2026-23920
EUVD-2026-1495224.03.2026, 19:16
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| zabbix | zabbix | 7.0.0 ≤ 𝑥 < 7.0.22 |
| zabbix | zabbix | 7.2.0 ≤ 𝑥 < 7.2.15 |
| zabbix | zabbix | 7.4.0 ≤ 𝑥 < 7.4.6 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases