CVE-2026-125357 Munin munin-httpd through 2.999.18 Path Traversal via Static File Handler

Medium 6.9 Published 9 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-125357?

CVE-2026-125357 is a medium-severity vulnerability in munin-monitoring munin, published on 9 Nov 2026.

Official description

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.

Weakness: CWE-22

Which versions are affected by CVE-2026-125357?

How do I fix CVE-2026-125357?

No fix has been published for CVE-2026-125357 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-125357 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-125357 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-p249-34gr-hj2h, UBUNTU-CVE-2026-125357.