CVE-2023-34096

Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.

• CWE-22

• http://packetstormsecurity.com/files/172822/Thruk-Monitoring-Web-Interface-3.06-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://galogetlatorre.blogspot.com/2023/06/cve-2023-34096-path-traversal-thruk.html
• https://github.com/galoget/Thruk-CVE-2023-34096
• https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L690Exploit
• https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L705Exploit
• https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L727Exploit
• https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L735Exploit
• https://github.com/sni/Thruk/commit/26de047275c355c5ae2bbbc51b164f0f8bef5c5bPatch
• https://github.com/sni/Thruk/commit/cf03f67621b7bb20e2c768bc62b30e976206aa17Patch
• https://github.com/sni/Thruk/security/advisories/GHSA-vhqc-649h-994hExploit, Vendor Advisory
• https://www.exploit-db.com/exploits/51509
• http://packetstormsecurity.com/files/172822/Thruk-Monitoring-Web-Interface-3.06-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://galogetlatorre.blogspot.com/2023/06/cve-2023-34096-path-traversal-thruk.html
• https://github.com/galoget/Thruk-CVE-2023-34096
• https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L690Exploit
• https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L705Exploit
• https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L727Exploit
• https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L735Exploit
• https://github.com/sni/Thruk/commit/26de047275c355c5ae2bbbc51b164f0f8bef5c5bPatch
• https://github.com/sni/Thruk/commit/cf03f67621b7bb20e2c768bc62b30e976206aa17Patch
• https://github.com/sni/Thruk/security/advisories/GHSA-vhqc-649h-994hExploit, Vendor Advisory
• https://www.exploit-db.com/exploits/51509

Published

Jun 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34090Decidim is a participatory democracy framework, written in R…7.5
• CVE-2023-34091Kyverno is a policy engine designed for Kubernetes. In versi…6.5
• CVE-2023-34092Vite provides frontend tooling. Prior to versions 2.9.16, 3.…7.5
• CVE-2023-34093Strapi is an open-source headless content management system.…7.1
• CVE-2023-34094ChuanhuChatGPT is a graphical user interface for ChatGPT and…5.3
• CVE-2023-34095cpdb-libs provides frontend and backend libraries for the Co…9.8
• CVE-2023-34097hoppscotch is an open source API development ecosystem. In v…8.8
• CVE-2023-34098Shopware is an open source e-commerce software. Due to an in…5.3
• CVE-2023-34099Shopware is an open source e-commerce software. The mail val…5.3
• CVE-2023-3410The Bricks theme for WordPress is vulnerable to Stored Cross…5.4
• CVE-2023-34100Contiki-NG is an open-source, cross-platform operating syste…6.5
• CVE-2023-34101Contiki-NG is an operating system for internet of things dev…9.1