{"cve":"CVE-2021-40905","nvd":{"published":"2022-03-25T23:15:08.237","modified":"2026-07-09T01:17:02.310","status":"Modified","description":"The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of \".mkp\" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-434"],"references":["https://docs.checkmk.com/latest/en/mkps.html","https://github.com/Edgarloyola/CVE-2021-40905","https://github.com/Edgarloyola/CVE-2021-40905"],"products":["checkmk:checkmk","tribe29:checkmk"],"source":"nvd","synced_at":"2026-10-19T21:29:06.454770966+00:00"},"epss":{"cve":"CVE-2021-40905","score":0.03027,"percentile":0.87473,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}