Checkmk Quicksearch allows a user to submit a search query that is processed by filter plugins. Because the input is not adequately sanitized, an authenticated user can embed Livestatus commands inside the query. This injection lets the attacker execute arbitrary Livestatus requests, potentially changing monitoring state, retrieving sensitive data, or escalating privileges within the monitoring system.

The flaw exists in Checkmk released by Checkmk GmbH, specifically in versions older than 2.5.0b4. The Quicksearch component of the web interface is the affected area.

The base CVSS score of 5.3 indicates a moderate severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated to the Checkmk web interface, after which a crafted query can inject Livestatus commands. No special privileges or preconditions beyond authentication are required, making the attack vector relatively straightforward for authorized users.