CVE-2026-23920
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode.
Published Mar 24, 2026 · updated Sep 10, 2026 · zabbix zabbix
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2026 · NIST NVD
Detected
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Sep 10, 2026 · NIST NVD
Updated
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Affected
- cpe zabbix/zabbixversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-23920
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-23920
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
nvd.nist.gov