Checkmk CVE-2025-39664

Exploitation requires an authenticated Checkmk account with access to the report scheduler feature (PR:L), and the attack targets the scheduler's handling of the report file-pair storage location, which insufficiently escapes path input and permits writing beyond the intended root directory. Limiting factors: the attacker must already hold valid application credentials (no pre-auth path), impact is confined to file write/placement affecting integrity and availability rather than data disclosure, and affected versions are Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46, and the EOL 2.1.0 - patched builds are not exploitable. No special non-default configuration beyond having the reporting/scheduler functionality in use.

Signals are largely consistent and point to a moderate, not emergency, priority. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity flaw but requires PR:L - an authenticated Checkmk user - which meaningfully limits the attacker pool to those who already hold valid application credentials. Impact is skewed toward integrity and availability (VC:N/VI:L/VA:H): the path traversal lets an attacker write report file pairs outside the intended root rather than read secrets, so confidentiality is unaffected. EPSS is low at 0.69% (52th percentile), and the vulnerability is NOT in CISA KEV, indicating no evidence of widespread active exploitation. However, publicly available exploit code exists (SBA Research advisory plus a Full Disclosure post), which raises practical risk above the EPSS baseline for internet-exposed or multi-tenant Checkmk instances. Net: a credentialed-attacker file-write/traversal issue worth prompt patching on exposed monitoring servers, but not a drop-everything, pre-auth RCE. No conflicting signals were found between the CVSS vector and the description - both agree on authenticated network access.

An authenticated Checkmk user with access to the report scheduler crafts a report configuration whose storage location contains traversal sequences that are insufficiently escaped, causing report file pairs to be written outside the intended root directory. Public exploit code is available (SBA Research advisory and a Full Disclosure posting), lowering the effort to reproduce. Because exploitation is network-reachable with low complexity, an attacker who has obtained any valid low-privilege account could overwrite or plant files to disrupt the monitoring service.