CVE-2022-24715 Arbitrary code execution for authenticated users in Icinga Web 2

What is CVE-2022-24715?

CVE-2022-24715 is a high-severity path traversal vulnerability in icingaweb2, published on 8 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.

Weakness: CWE-22

Which versions are affected by CVE-2022-24715?

It affects 1 product.

Products include Icinga Icinga Web 2.

How do I fix CVE-2022-24715?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-24715 being exploited?

There is no known exploitation of CVE-2022-24715 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 3 proofs of concept on GitHub.

Other vulnerabilities in icingaweb2

• CVE-2018-18249 Code injection in n/a Critical 9.8
• CVE-2025-27404 Icinga Web 2 DOM-based XSS vulnerability High 7.7
• CVE-2025-27405 Icinga Web 2 has XSS in embedded content High 7.7
• CVE-2022-24716 Path traversal in Icinga Web 2 High 7.5
• CVE-2018-18250 Other in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-24715, GHSA-v9mv-h52f-7g63, UBUNTU-CVE-2022-24715.