CVE-2023-34096 | Thruk has Path Traversal Vulnerability in panorama.pm
Exp
Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.
Conclusion & alert: CVE-2023-34096 is rated High Exploit Risk (80.1/100): CVSS Medium severity, with high exploitation likelihood (EPSS 45.11%, 97th percentile).Core evidence: 7 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +6.88% over the last day, indicating growing attacker interest.Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
Public exploit references (Exploit-DB) for CVE-2023-34096
Exploit prediction scoring system (EPSS) score for CVE-2023-34096
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).