# CVE-2023-45858: Paessler PRTG path traversal in webserver

Source: https://junglewise.ai/threats/cve-2023-45858-paessler-prtg-path-traversal-in-webserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-45858 · Severity: high · CVSS 8.6 · Published 2026-09-14

Paessler PRTG is a network monitoring platform used by over 500,000 organizations to track system performance and availability. A path traversal vulnerability in the PRTG webserver allows unauthenticated attackers to read arbitrary local files from the server, potentially exposing sensitive configuration data, credentials, or other confidential information without requiring any authentication.

Vendors: [Paessler](https://junglewise.ai/threats/vendors/paessler).

## Quick answers

**Is CVE-2023-45858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-45858 being exploited in the wild.

**How severe is CVE-2023-45858?** High severity, with a CVSS score of 8.6, published 14 September 2026.

**Which products and versions are affected?** Paessler PRTG before 23.4.88.1429.

**Is there a fix for CVE-2023-45858?** A patch was published on 2023-10-16: Fixed in version 23.4.88.1429 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-45858 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-45858?** Check whether you run Paessler PRTG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal (directory traversal) vulnerability was identified in the PRTG webserver component, allowing attackers to access files outside the intended directory by manipulating file path parameters. The vulnerability is exploitable without authentication, meaning any network-accessible attacker can trigger it. By crafting malicious requests with traversal sequences (e.g., ../ or similar), an attacker can read arbitrary files from the server's filesystem. The vulnerability was fixed in PRTG version 23.4.88.1429 and later. No evidence of active exploitation in the wild has been reported as of the advisory date.

## Affected products

- Paessler PRTG before 23.4.88.1429

## Timeline

- 2023-10-16: disclosed: CVE-ID published
- 2023-10-16: patched: Fixed in version 23.4.88.1429

## References

- [https://helpdesk.paessler.com/en/support/solutions/articles/76000076525-what-is-the-vulnerability-fixed-in-prtg-23-4-88-1429-about-](https://helpdesk.paessler.com/en/support/solutions/articles/76000076525-what-is-the-vulnerability-fixed-in-prtg-23-4-88-1429-about-)
- [https://www.paessler.com/prtg/history/stable](https://www.paessler.com/prtg/history/stable)