CVE-2026-23920

EUVD-2026-14952
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 19.85%
Affected Products (NVD)
VendorProductVersion
zabbixzabbix
7.0.0 ≤
𝑥
< 7.0.22
zabbixzabbix
7.2.0 ≤
𝑥
< 7.2.15
zabbixzabbix
7.4.0 ≤
𝑥
< 7.4.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
zabbix
bookworm
ignored
forky
1:7.0.29+dfsg-2
fixed
sid
1:7.0.29+dfsg-2
fixed
trixie
1:7.0.22+dfsg-1~deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zabbix
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
questing
ignored
resolute
not-affected
trusty
needs-triage
xenial
needs-triage