CVE-2024-39915

Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API. This authenticated RCE in Thruk allows authorized users with network access to inject arbitrary commands via the URL parameter during PDF report generation. The Thruk web application does not properly process the url parameter when generating a PDF report. An authorized attacker with access to the reporting functionality could inject arbitrary commands that would be executed when the script /script/html2pdf.sh is called. The vulnerability can be exploited by an authorized user with network access. This issue has been addressed in version 3.16. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-94

• https://github.com/sni/Thruk/commit/7e7eb251e76718a07639c4781f0d959d817f173b
• https://github.com/sni/Thruk/security/advisories/GHSA-r7gx-h738-4w6f
• https://github.com/sni/Thruk/commit/7e7eb251e76718a07639c4781f0d959d817f173b
• https://github.com/sni/Thruk/security/advisories/GHSA-r7gx-h738-4w6f

Published

Jul 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39909KubeClarity is a tool for detection and management of Softwa…6.5
• CVE-2024-3991The ShopLentor – WooCommerce Builder for Elementor & Gutenbe…5.4
• CVE-2024-39910decidim is a Free Open-Source participatory democracy, citiz…4.8
• CVE-2024-399111Panel is a web-based linux server management control panel.…9.8
• CVE-2024-39912web-auth/webauthn-lib is an open source set of PHP libraries…5.3
• CVE-2024-39914FOG is a cloning/imaging/rescue suite/inventory management s…9.8
• CVE-2024-39916FOG is a free open-source cloning/imaging/rescue suite/inven…6.4
• CVE-2024-39917xrdp is an open source RDP server. xrdp versions prior to 0.…9.8
• CVE-2024-39918@jmondi/url-to-png is an open source URL to PNG utility feat…4.3
• CVE-2024-39919@jmondi/url-to-png is an open source URL to PNG utility feat…3.1
• CVE-2024-3992The Amen WordPress plugin through 3.3.1 does not sanitise an…4.8
• CVE-2024-39920The TCP protocol in RFC 9293 has a timing side channel that …4.3