Suse EUVD-2026-14952

Zabbix implements input validation for host and event action scripts using administrator-configurable regular expressions. The vulnerability stems from a common regex anchoring flaw (CWE-78: Improper Neutralization of Special Elements used in an OS Command) where the regex engine operates in multiline mode. In multiline mode, the ^ anchor matches at the start of any line and $ matches at the end of any line, not just the string boundaries. An authenticated attacker can inject a newline character followed by malicious shell commands, causing the regex to match the first line (which may pass validation) while the injected payload on subsequent lines executes without validation. This is a classic example of insufficient input sanitization combined with regex mode misconfiguration. The affected product is Zabbix (CPE: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*), where the script execution engine processes these unsanitized inputs directly as shell commands.