Zabbix host and event action scripts are filtered by a user‑defined regular expression but the pattern is evaluated in multiline mode. An attacker who can set a script can insert a newline, causing the ^ and $ anchors to apply only to the first line and allowing crafted input to bypass validation. The result is that arbitrary shell commands are executed with the privileges of the Zabbix server, posing a risk of data theft, system compromise, or denial of service. The weakness is a classic command injection flaw (CWE‑78).

The vulnerability affects Zabbix products. Specific component names and version ranges are not listed in the advisory, so all installations that allow host or event scripts configured with a regex validator are potentially exposed until a patch is applied.

The CVSS score is 7.7, indicating high severity. No EPSS score is available, and the issue is not included in CISA's KEV catalog. Exploitation requires an authenticated user with permission to configure host or event scripts, so the attack vector is internal rather than remote. Because the vulnerability is not publicly exposed for arbitrary users, the likelihood of wide‑scale exploitation is lower, but the impact remains significant for compromised accounts.