Thruk has Path Traversal Vulnerability in panorama.pm

Summary

Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.

Timeline

1. Jun 8, 2023, 6:59 PM UTCCVE published
2. Jun 9, 2023Public exploit on Exploit-DB

   EDB-51509

3. Jan 6, 2025, 7:46 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: partial

4. Feb 13, 2025, 4:55 PM UTCRecord last updated
5. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• sni Thruk

  fixed in 3.06.2

References 11