Zabbix 7.2.x < 7.2.15 Multiple Vulnerabilities

high Web App Scanning Plugin ID 115516

Synopsis

Description

According to its self-reported version number, the version of Zabbix running on the remote host is 6.0.x prior to 6.0.44, or 7.0.x prior to 7.0.23, or 7.2.x prior to 7.2.15, or 7.4.x prior to 7.4.7. It is, therefore, affected by multiple vulnerabilities :

- A blind, read-only SQL injection vulnerability in include/classes/api/CApiService.php, as a low privilege user with API access can execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. (CVE-2026-23921)

- An OS command injection vulnerability, as host and event action script input is validated with an administrator-defined regex that runs in multiline mode. If the ^ and $ anchors are used, an injected newline lets authenticated users bypass the check and inject shell commands. (CVE-2026-23920)

- An insufficient isolation of the JavaScript (Duktape) execution context on the Zabbix server and proxy, as contexts used by script items, JavaScript preprocessing and webhooks are reused for performance reasons. This can lead to a confidentiality loss where a regular (non-super) administrator leaks data for hosts they do not have access to. (CVE-2026-23919)

- An unsafe reflection vulnerability, as an unauthenticated attacker can exploit the frontend 'validate' action to blindly instantiate arbitrary PHP classes. (CVE-2026-23923)

- An argument injection vulnerability in the Agent 2 Docker plugin, which does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon, allowing an attacker able to invoke Agent 2 to read arbitrary files from running Docker containers. (CVE-2026-23924)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.