CVE-2021-32746: 
Icinga vulnerability analysis and mitigation

Icinga Web 2, an open source monitoring web interface and framework, contained a path traversal vulnerability (CVE-2021-32746) affecting versions 2.3.0 through 2.8.2. The vulnerability was discovered and disclosed on July 12, 2021. The issue exists in the doc module, which allows users to view documentation directly in the UI (GitHub Advisory).

The vulnerability allows authenticated users with access to the doc module to perform path traversal attacks. By accessing a specific route /icingaweb2/doc/module/image with manipulated parameters, an attacker could gain access to arbitrary files readable by the web-server user. The vulnerability has a CVSS v3.1 Base Score of 5.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (AttackerKB).

If successfully exploited, the vulnerability allows attackers to read arbitrary files that are accessible to the web server user, potentially exposing sensitive system information and configurations (GitHub Advisory).

The vulnerability has been patched in versions 2.9.0, 2.8.3, and 2.7.5. As a workaround, administrators can either disable the doc module entirely or revoke permission to use it from all users (GitHub Advisory).