Opsview Monitor Pro - Path Traversal (CVE-2016-10367)

CVE-2016-10367 is a directory traversal vulnerability in Opsview Monitor Pro versions prior to several 5.x and 4.x releases, allowing unauthenticated attackers to access sensitive files on the server by exploiting a URL encoding bypass. This flaw could be leveraged to read arbitrary files, potentially exposing confidential information and aiding further attacks.

CrowdSec has been tracking this vulnerability and its exploits since 10th of September 2025.

CrowdSec network observations suggest that most exploitation of CVE-2016-10367 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. CrowdSec data also reveals a clear uptick in attacks involving CVE-2016-10367 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit this vulnerability by sending requests to URLs containing /monitoring/..%252f..%252f with multiple encoded directory traversal sequences to access sensitive files such as /etc/passwd.