openITCOCKPIT Community Edition before version 5.5.2 contains a command‑injection flaw that lets an authenticated user who can add or alter host definitions inject arbitrary operating‑system commands into the host address field. The value is incorporated into monitoring templates and passed to the monitoring engine (Nagios or Icinga) through a shell without sanitisation, escaping or quoting, allowing an attacker to execute any OS command on the backend and gain full control of the monitoring system.

All installations of openITCOCKPIT Community Edition released prior to 5.5.2 are affected. The flaw is tied to host configurations editable by users with host‑management rights, and the vendor has provided a patch in release 5.5.2 that removes the unsanitised macro expansion.

With a CVSS score of 8.8, the vulnerability is classified as High. The exploit requires authenticated users who can modify host records, so attackers with compromised credentials or elevated privileges can immediately gain remote code execution. The lack of EPSS or KEV data does not reduce the risk, as the high severity score and the fact that the attack path exploits the monitoring engine’s shell invocation point to a serious threat for environments using openITCOCKPIT.