Administrator code execution via crafted MKP upload

Code execution in the Checkmk Enterprise Edition web console 1.5.0 through 2.0.0p8 allows remote authenticated users to run code via MKP uploads. The console accepts an extension package and, after administrator activation, installs its contents into the site's local extension tree, where extension code becomes active. An administrator account or hijacked administrator session and package activation are required, and the vendor disputes the issue because administrators are intended to execute extension code.