{“lastseen”:””,”description”:”Insufficient escaping in the report scheduler within Checkmk \\u003c2.4.0p13, \\u003c2.3.0p38, \\u003c2.2.0p46 and 2.1.0 (EOL) allows authenticated attackers to define the storage location of report file pairs beyond their intended root directory.”,”published”:”2025-10-09T15:01:55.877Z”,”modified”:”2025-10-09T15:01:55.877Z”,”type”:”cve”,”title”:”Path-Traversal in report scheduler”,”source”:”Checkmk”,”references”:”https:\/\/checkmk.com\/werk\/17984″,”id”:”CVE-2025-39664″,”bulletinFamily”:””,”cwe”:[“CWE-22″],”cvelist”:null,”sourceData”:”Checkmk GmbH Checkmk 2.4.0\\nCheckmk GmbH Checkmk 2.3.0\\nCheckmk GmbH Checkmk 2.2.0\\nCheckmk GmbH Checkmk 2.1.0″,”sourceHref”:””,”cvss”:{“score”:7.1,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:N\/VI:L\/VA:H\/SC:N\/SI:N\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Checkmk”,”version”:”2.4.0″,”vendor”:”Checkmk GmbH”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”Insufficient escaping in the report scheduler within Checkmk \\u003c2.4.0p13, \\u003c2.3.0p38, \\u003c2.2.0p46 and 2.1.0 (EOL) allows authenticated attackers to define the storage location of report file…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,50,12,15,13,7,11,5],"class_list":["post-20809","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-71","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n