CVE-2026-125357
5.3 MEDIUMpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Public exploit & PoC references
All references
- https://github.com/munin-monitoring/munin
- https://github.com/munin-monitoring/munin/blob/2.999.18/lib/Munin/Master/HTML.pm#L30-L58
- https://github.com/munin-monitoring/munin/commit/e7b6f452ccca04cff8a0e7285c1279b116a768e1
- https://github.com/munin-monitoring/munin/issues/1710
- https://www.vulncheck.com/advisories/munin-munin-httpd-through-2.999.18-path-traversal-via-static-file-handler
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2012-20002PoC
- HIGHCVE-2014-125130PoC
- HIGHCVE-2014-125133PoC
- HIGHCVE-2014-125134PoC
- HIGHCVE-2015-20123PoC
- HIGHCVE-2015-20124PoC
- HIGHCVE-2015-20125PoC
- HIGHCVE-2016-20100PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.