Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handlerequest that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.

An insecure temporary file use flaw was found in the way qmailscan (plug-in to graph output from qmailscan and clamav) plug-in of the Munin, a network-wide graphing framework performed scan of qmailscan log files for presence of disallowed characters. A local attacker could use this flaw to conduct symbolic link attacks (possibly leading to attacker's ability to overwrite or remove arbitrary files, belonging to the user, running the Munin qmailscan log files scannning).

References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668778