Vulnerabilities

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053.

The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd would (in effect) determine part of the configuration.