CVE-2026-125357: Munin munin-httpd through 2.999.18 Path Traversal via Static File Handler
Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handlerequest that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Munin munin-httpd versions 2.99.1 through 2.999.18 are affected. The vulnerable component is the static file handler in Munin::Master::HTML::handle_request.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can exploit the issue remotely by requesting a path such as /static/../<file>.
What information could be exposed?
Attackers can read files outside the intended static directory, including munin.conf and files under plugin-conf.d. These files may contain credentials for monitored services.