CVE-2025-64996 MEDIUM

CVE-2025-64996: Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output

Vendor Checkmk Gmbh
Product Checkmk
Weakness CWE-732
Published November 18, 2025
Last update November 18, 2025

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

What the vulnerability does

01Description

In Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older, the mk_inotify plugin creates world-readable and writable files, allowing any local user on the system to read the plugin's output and manipulate it, potentially leading to unauthorized access to or modification of monitoring data.

Key dates

02Disclosure timeline

November 18, 2025 CVE published
November 18, 2025 Record updated