Path Traversal in ntopng Web Interface

Executive Summary

CVE-2026-83621 is a vulnerability in ntopng, a network traffic monitoring tool. It allows any authenticated user, even without admin rights, to modify threat intelligence blacklist settings via a REST API endpoint. This includes changing blacklist URLs to malicious ones, disabling blacklists to bypass security, or preventing scheduled updates to avoid detection.

Useful 0 Not Useful 0

Detection Guidance

Check ntopng logs for unauthorized POST requests to /lua/rest/v2/edit/system/edit_blacklist.lua from non-admin users. Inspect Redis for modified blacklist configurations or unexpected URL changes in threat-intelligence downloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid login credentials could redirect threat intelligence downloads to attacker-controlled servers, disable security blacklists to evade detection, or stop scheduled updates to prevent future threat blocking. This undermines the integrity and availability of ntopng's threat monitoring.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by allowing unauthorized users to disable threat intelligence blacklists or redirect updates to malicious servers. This may result in undetected security breaches, data exfiltration, or unauthorized access, violating data protection and security requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ntopng to version 6.7.260717 or later. Review and audit all authenticated users with access to the REST API. Monitor for suspicious changes to blacklist configurations or threat-intelligence URLs.

Useful 0 Not Useful 0