Opsview Monitor Pro - Path Traversal (CVE-2016-10367)

CVE-2016-10367 is a directory traversal vulnerability in Opsview Monitor Pro versions prior to several 5.x and 4.x releases, allowing unauthenticated attackers to access sensitive files on the server by exploiting a URL encoding bypass. This flaw could be leveraged to read arbitrary files, potentially exposing confidential information and aiding further attacks.

CrowdSec has been tracking this vulnerability and its exploits since 10th of September 2025.

CrowdSec network observations suggest that most exploitation of CVE-2016-10367 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2016-10367 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2016-10367 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit this vulnerability by sending requests to URLs containing /monitoring/..%252f..%252f with multiple encoded directory traversal sequences to access sensitive files such as /etc/passwd.