CVE catalog

CVE-2021-32746

icingaweb2: CVE-2021-32746

Severity: Medium
Published: Jul 12, 2021, 11:15:07 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.31% · Oct 25, 2026

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` module of Icinga Web 2 allows to view documentation directly in the UI. It must be enabled manually by an administrator and users need explicit access permission to use it. Then, by visiting a certain route, it is possible to gain access to arbitrary files readable by the web-server user. The issue has been fixed in the 2.9.0, 2.8.3, and 2.7.5 releases. As a workaround, an administrator may disable the `doc` module or revoke permission to use it from all users.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	icingaweb2	sid	`2.14.0-1`	fixed
Debian	icingaweb2	forky	`2.14.0-1`	fixed
Debian	icingaweb2	trixie	`2.12.4-2`	fixed
Debian	icingaweb2	bookworm	`2.11.4-2+deb12u1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	icingaweb2	source	sid	`2.8.4-1`	not yet assigned	Not reported	[991116]
Debian	icingaweb2	source	forky	`2.8.4-1`	not yet assigned	Not reported	[991116]
Debian	icingaweb2	source	trixie	`2.8.4-1`	not yet assigned	Not reported	[991116]
Debian	icingaweb2	source	bookworm	`2.8.4-1`	not yet assigned	Not reported	[991116]

[Debian bug #991116]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[icingacli]Fixed
Source package: [icingaweb2]
Details (2)
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
[icingaweb2]Fixed
Details (2)
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
[icingaweb2-common]Fixed
Source package: [icingaweb2]
Details (2)
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
[icingaweb2-module-doc]Fixed
Source package: [icingaweb2]
Details (2)
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
[icingaweb2-module-monitoring]Fixed
Source package: [icingaweb2]
Details (2)
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
[php-icinga]Fixed
Source package: [icingaweb2]
Details (2)
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12
- 2.11.4-2+deb12u1 · all · bookworm
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · bookworm; dsa · icingaweb2 · debian · 12

[Debian 13 (Trixie)]

[icingacli]Fixed
Source package: [icingaweb2]
Details (2)
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
[icingaweb2]Fixed
Details (2)
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
[icingaweb2-common]Fixed
Source package: [icingaweb2]
Details (2)
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
[icingaweb2-module-doc]Fixed
Source package: [icingaweb2]
Details (2)
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
[icingaweb2-module-monitoring]Fixed
Source package: [icingaweb2]
Details (2)
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
[php-icinga]Fixed
Source package: [icingaweb2]
Details (2)
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13
- 2.12.4-2 · all · trixie
  Fixed · Fixed: 2.8.4-1
  dsa · icingaweb2 · debian · 13

Observed: Oct 23, 2026, 5:57:35 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]