CVE-2026-125357
Munin munin-httpd through 2.999.18 Path Traversal via Static File Handler
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.
| CWE | CWE-22 |
| Vendor | munin-monitoring |
| Product | munin |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for munin-monitoring munin
Be the first to know when new medium vulnerabilities affecting munin-monitoring munin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
munin-monitoring / munin
2.99.1 ≤ 2.999.18
References
github.com: https://github.com/munin-monitoring/munin/issues/1710 github.com: https://github.com/munin-monitoring/munin github.com: https://github.com/munin-monitoring/munin/blob/2.999.18/lib/Munin/Master/HTML.pm#L30-L58 github.com: https://github.com/munin-monitoring/munin/commit/e7b6f452ccca04cff8a0e7285c1279b116a768e1 vulncheck.com: https://www.vulncheck.com/advisories/munin-munin-httpd-through-2.999.18-path-traversal-via-static-file-handler
Credits
George Chen