CVE-2022-24716: Icinga Web 2 unauthenticated path traversal file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable file disclosure of database credentials with a very high EPSS score, though not listed in KEV.

What it is

Icinga Web 2 fails to properly restrict path traversal, letting unauthenticated users read files on the local system that are accessible to the web-server user. This includes icingaweb2 configuration files that hold database credentials, so the flaw exposes secrets that can be reused elsewhere. It is fixed in versions 2.9.6 and 2.10.

Impact

An attacker gains read access to arbitrary files readable by the web-server user, including configuration files containing database credentials. Those credentials can then be used to reach the backend database or other connected systems.

Attack surface

Reachable over the network through the Icinga Web 2 HTTP interface with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any host exposing the web interface is in scope.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.89378 (99.8th percentile), and public references include a Packet Storm arbitrary file disclosure write-up, indicating active interest and likely exploit availability.

What to do

• Upgrade Icinga Web 2 to 2.9.6 or 2.10 as the primary fix.
• Rotate all database credentials stored in icingaweb2 configuration files, since they may already be exposed.
• Restrict network access to the Icinga Web 2 interface to trusted management networks or place it behind an authenticated reverse proxy.
• Run the web server under a least-privilege account so file reads are limited to what is strictly needed.
• Audit configuration file permissions to ensure secrets are not readable by the web-server user where avoidable.

Detection

• Review web server access logs for requests containing path traversal sequences such as ../ or encoded variants targeting Icinga Web 2 endpoints.
• Alert on unexpected reads of icingaweb2 configuration files or other sensitive paths by the web-server process.
• Monitor for authentication attempts or connections to the backend database using the Icinga Web 2 credentials from unexpected sources.
• Check exposed Icinga Web 2 instances for version below 2.9.6 or 2.10 to identify unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.