CVE-2026-7186 — Fix stored XSS in URL dashboard widget via dangerous URI schemes

CVE-2026-7186

Fix stored XSS in URL dashboard widget via dangerous URI schemes PUBLISHED

Description (CNA)

Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the dashboard.

Affected (CNA)

Vendor / product	Versions
Checkmk GmbH / Checkmk	affected 2.5.0 before 2.5.0p5; affected 2.4.0 before 2.4.0p31; affected 2.3.0 before 2.3.0p48; affected 2.2.0

CWE

CWE-79

References

https://checkmk.com/werk/17991

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.