MEDIUM 6.9 NVD
CVE-2026-125357
Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows
Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.
References
- https://github.com/munin-monitoring/munin
- https://github.com/munin-monitoring/munin/blob/2.999.18/lib/Munin/Master/HTML.pm#L30-L58
- https://github.com/munin-monitoring/munin/commit/e7b6f452ccca04cff8a0e7285c1279b116a768e1
- https://github.com/munin-monitoring/munin/issues/1710
- https://www.vulncheck.com/advisories/munin-munin-httpd-through-2.999.18-path-traversal-via
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-10 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.