What’s Vulnerable › Vulnerabilities
CVE-2022-46768: File name information disclosure vulnerability in Zabbix Web Service Report Generation
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 47.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-12-15 · updated 2026-06-17
- Weakness: CWE-20
Description
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
Affected products
- Zabbix Web Service Report Generation: from 6.0.0 through 6.0.11; from 6.2.0 through 6.2.5
- Zabbix-Agent2: before 6.0.12; from 6.2.0 before 6.2.6 — fixed in 6.0.12, 6.2.6
How to fix
Upgrade to a fixed version: Zabbix-Agent2 6.0.12, 6.2.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2022-46768 or the next vulnerability affects your stack