CVE-2026-23920
EUVD-2026-1495224.03.2026, 19:16
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| zabbix | zabbix | 7.0.0 ≤ 𝑥 ≤ 7.0.21 |
| zabbix | zabbix | 7.2.0 ≤ 𝑥 ≤ 7.2.14 |
| zabbix | zabbix | 7.4.0 ≤ 𝑥 ≤ 7.4.5 |
𝑥
= Vulnerable software versions