An authenticated user with access to Checkmk can craft a malicious link containing characters such as javascript: URIs, because the URL validation logic fails to neutralize HTML‑encoded characters. When another user clicks the link, the browser interprets the malicious payload as executable code, allowing the attacker to run arbitrary scripts in the victim’s session. The underlying weakness is input validation and sanitisation (CWE‑79) and the impact is browser‑based cross‑site scripting.

Checkmk products from Checkmk GmbH are vulnerable in all versions prior to 2.5.0p5, prior to 2.4.0p31, prior to 2.3.0p48, and every 2.2.0 release. Any environment running one of these affected releases is subject to the vulnerability.

With a CVSS score of 8.5 the flaw is considered high severity. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog. Exploitation requires that an attacker be authenticated to the Checkmk instance to create the problematic link, and that a different user later click on that link. Once triggered the effect is immediate XSS in the victim’s browser, allowing an attacker to steal session data, deface pages, or perform account takeover actions.