Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal flaw in its static file handler that allows attackers to access files outside the intended static directory without authentication. The flaw can expose critical configuration files such as munin.conf and plugin-conf.d, which may hold monitored service credentials. This vulnerability represents a confidentiality breach due to the underlying weakness identified as CWE-22.

The affected software is the Munin monitoring package, specifically munin-httpd version 2.99.1 and all releases up to 2.999.18. Users running any of these versions exposed on a web server without proper access restrictions are vulnerable.

The CVSS score of 6.9 indicates a medium level of severity, and the EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits are disclosed. Exploitation can occur by making a simple HTTP GET request to /static/../<target-file>, bypassing the server’s path sanitization to read arbitrary files.