CVE-2026-125357

Name of the Vulnerable Software and Affected Versions Munin munin-httpd versions 2.99.1 through 2.999.18

Description A path traversal issue exists in the static file handler of the handle request() function within Munin::Master::HTML. This allows unauthenticated attackers to access files outside the intended static directory by requesting /static/../<file>, which bypasses the check for the /../ substring. This can lead to the exposure of munin.conf and plugin-conf.d files, which may contain credentials for monitored services.

Recommendations Update Munin munin-httpd to a version newer than 2.999.18.