CVE-2022-24716— Path traversal in Icinga Web 2
Quick assessment
Affected
Icinga icingaweb2
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Icinga Web 2是一个应用软件。Icinga Web 2是Icinga Project开发的下一代开源监控 Web 界面、框架和命令行界面，支持 Icinga 2、Icinga Core 和任何其他兼容 IDO 数据库的监控后端。 Icinga Web 2 存在路径遍历漏洞，该漏洞源于未经认证的Icinga Web 2 用户可以泄露web-server用户可以访问的本地系统文件的内容，包括带有数据库凭据的“icingaweb2”配置文件。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-24716
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path traversal in Icinga Web 2
Source: CVE Program / CVE List V5
Vulnerability Description
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Icinga Web 2 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Icinga Web 2是一个应用软件。Icinga Web 2是Icinga Project开发的下一代开源监控 Web 界面、框架和命令行界面，支持 Icinga 2、Icinga Core 和任何其他兼容 IDO 数据库的监控后端。 Icinga Web 2 存在路径遍历漏洞，该漏洞源于未经认证的Icinga Web 2 用户可以泄露web-server用户可以访问的本地系统文件的内容，包括带有数据库凭据的“icingaweb2”配置文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Icinga | icingaweb2 | >= 2.9.0, < 2.9.6 | - |
|
II. Public POCs for CVE-2022-24716
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Arbitrary File Disclosure Vulnerability in Icinga Web 2 <2.8.6, <2.9.6, <2.10 | https://github.com/JacobEbben/CVE-2022-24716 | POC Details |
| 2 | CVE-2022-24716 (Arbitrary File Disclosure Icingaweb2) | https://github.com/joaoviictorti/CVE-2022-24716 | POC Details |
| 3 | None | https://github.com/pumpkinpiteam/CVE-2022-24716 | POC Details |
| 4 | Arbitrary File Disclosure Vulnerability in Icinga Web 2 <2.8.6, <2.9.6, <2.10 | https://github.com/doosec101/CVE-2022-24716 | POC Details |
| 5 | None | https://github.com/antisecc/CVE-2022-24716 | POC Details |
| 6 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24716.yaml | POC Details |
| 7 | CVE-2022-24716 (Arbitrary File Disclosure Icingaweb2) | https://github.com/gmh5225/CVE-2022-24716-2 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-24716
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-24716 (1)
Vendor Advisories for CVE-2022-24716 (2)
-
https://security.gentoo.org/glsa/202208-05 vendor-advisory
Same Patch Batch · Icinga · 2022-03-08 · 3 CVEs total
| CVE-2022-24715 | 8.5 HIGH | Arbitrary code execution for authenticated users in Icinga Web 2 |
| CVE-2022-24714 | 5.3 MEDIUM | Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2 |
IV. Related Vulnerabilities
Same product: icingaweb2
-
CVE-2025-30164
Icinga Web 2 has open redirect on login page -
CVE-2025-27609
Icinga Web 2 Vulnerable to Reflected XSS -
CVE-2025-27405
Icinga Web 2 has XSS in embedded content -
CVE-2025-27404
Icinga Web 2 DOM-based XSS vulnerability -
CVE-2022-24714
Disclosure of hosts and related data, linked to decommission
Same vendor: Icinga
-
CVE-2026-42224
ipl/web is vulnerable to reflected XSS by malformed search r -
CVE-2026-24414
Icinga for Windows certificate can have too-open permissions -
CVE-2026-24413
Icinga has insecure permission of %ProgramData%\icinga2\var -
CVE-2025-61909
Icinga 2 signals sent as root to processes based on PID file -
CVE-2025-61908
Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Re
Same weakness: CWE-22
-
CVE-2026-68062
SKYSEA Client View路径遍历漏洞 -
CVE-2026-78638
peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js u -
CVE-2026-78677
GitPython before 3.1.59 Path Traversal via separate-git-dir -
CVE-2026-72697
Grav CMS before 2.0.16 Path Traversal via media_directory -
CVE-2026-72695
Grav before 2.0.16 Path Traversal via MediaUploadTrait delet
V. Comments for CVE-2022-24716
No comments yet