CVE-2026-23920

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.2.0"
                },
                {
                    "fixed": "7.2.15"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "zabbix:zabbix"
        }
    ]
}

References

https://support.zabbix.com/browse/ZBX-27639

Affected packages

Git / github.com/zabbix/zabbix

Affected ranges

Type

GIT

Repo

https://github.com/zabbix/zabbix

Events

Introduced

49955f1fb5c9168a8a24b053f7ade6b3d903143c

Fixed

ba52e2ee4ff8768c8450819a772886d79dcde0b4

Introduced

372a4e93c48ecd25aa666949a055a02369031861

Fixed

626d2b8a4820a424efe8fd39df3b706468f1e5d4

Database specific

Show details

{
    "cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.22"
        },
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

7.*

7.0.0

7.0.1

7.0.10

7.0.10rc1

7.0.11

7.0.11rc1

7.0.11rc2

7.0.12

7.0.12rc1

7.0.13

7.0.13rc1

7.0.14

7.0.14rc1

7.0.15

7.0.16

7.0.17

7.0.17rc1

7.0.17rc2

7.0.18

7.0.18rc1

7.0.18rc2

7.0.19

7.0.19rc1

7.0.1rc1

7.0.1rc2

7.0.2

7.0.20

7.0.20rc1

7.0.21

7.0.22rc1

7.0.22rc2

7.0.22rc3

7.0.2rc1

7.0.2rc2

7.0.3

7.0.3rc1

7.0.4

7.0.4rc1

7.0.5

7.0.5rc1

7.0.6

7.0.6rc1

7.0.7

7.0.7rc1

7.0.8

7.0.8rc1

7.0.8rc2

7.0.9

7.0.9rc1

7.0.9rc2

7.4.0

7.4.1

7.4.1rc1

7.4.2

7.4.2rc1

7.4.2rc2

7.4.3

7.4.3rc1

7.4.4

7.4.4rc1

7.4.5

7.4.6rc1

7.4.6rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23920.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "335575185657139336988338025089072345512",
                "144097728509264372924349761206701036791",
                "185724688006201679055704973376898360796",
                "130162026250320242787979560813111933511",
                "70354792077183199662061649065794713982",
                "152321436213664381476643075846246568564"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-23920-6d3c1d38",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zabbix/zabbix/commit/626d2b8a4820a424efe8fd39df3b706468f1e5d4",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "335575185657139336988338025089072345512",
                "144097728509264372924349761206701036791",
                "265387215296323665047876836033014923187",
                "72110328909359773811350994976134420490",
                "245919019046659487345219626549275780890",
                "41189996272314509887159037345751552815"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-23920-8066b192",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zabbix/zabbix/commit/ba52e2ee4ff8768c8450819a772886d79dcde0b4",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    }
]

vanir_signatures_modified

"2026-09-12T08:14:50Z"