Description

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-14T06:16:54.357Z",
  "pubdate": "2026-09-14T06:16:54.357Z",
  "executiveSummary": "A directory traversal vulnerability exists in Paessler PRTG versions prior to 23.4.88.1429, allowing unauthorized actors to read sensitive local files on the underlying host system.\nThe vulnerability originates from improper neutralization of special elements within pathnames used in file system operations. By manipulating input parameters, an attacker can bypass intended directory restrictions to access arbitrary files outside the application's root directory.\nThe impact includes the unauthorized disclosure of sensitive system information, configuration files, credentials, or application data, potentially leading to a full system compromise depending on the data retrieved.\nThis vulnerability poses a significant security risk as it allows an unauthenticated or low-privileged attacker to traverse the file system hierarchy. Remediation requires an immediate update to the specified patched version to neutralize the exploitation vector.",
  "technicalDetails": "The identified vulnerability is a classic directory traversal, also known as path traversal (CWE-22). The root cause lies in the application's failure to adequately validate or sanitize user-supplied input before passing it to filesystem-related APIs or functions responsible for file retrieval.\nIn Paessler PRTG, the vulnerability manifests when the application processes requests that involve file path manipulation. If the application does not strictly constrain access to a specific sandboxed directory, an attacker can inject sequence characters such as dot-dot-slash (../) into request parameters.\nThe attack flow commences with the identification of an endpoint or request parameter that handles file paths. The attacker crafts a request containing directory traversal sequences, such as '../../../../etc/passwd' or similar sensitive file paths, depending on the host operating system.\nWhen the application processes this malicious input, the operating system resolves the traversal sequences, effectively 'escaping' the intended working directory. The application then inadvertently treats the resulting path as a legitimate request, leading to the retrieval and exposure of files that should remain inaccessible to the user.\nBecause the application performs these operations with the privileges of the PRTG service account, any file readable by that account can be exfiltrated. This is particularly critical in Windows environments, where the service might run with high privileges, potentially exposing configuration files containing database connection strings, hashed credentials, or sensitive environmental data.\nThe vulnerability affects all Paessler PRTG versions prior to 23.4.88.1429. Successful exploitation does not inherently require complex execution chains; rather, it relies on the application's failure to implement path canonicalization or strict allow-listing of permitted files.\nPost-exploitation, an attacker can leverage the retrieved information to conduct further reconnaissance, facilitate privilege escalation, or gain unauthorized access to backend systems integrated with PRTG. As the application is often deployed within internal network segments, this vulnerability provides a significant pivot point for lateral movement."
}