EUVD-2026-62184Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack requiring monitoring account; sudoers execution as root enables high confidentiality impact; no integrity or availability effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confining the resolved path to /var/log. An attacker who controls the monitoring account can select a root-readable file such as /etc/shadow and use --warning-regex . while leaving SUPPRESS_OUTPUT false, causing each nonempty line to be collected in warn_matches and returned through lib.base.oao(). The vulnerable flow passes the expanded scan_path directly to open(), and neither real-path containment nor an allowlist protects the sink. The same fix also confines mysql-logfile and openvpn-client-list paths, allows only documented log roots, and resolves symlinks and parent-directory traversal before checking containment. This issue is fixed in version 7.0.0.
AnalysisAI
Arbitrary root-readable file disclosure in Linuxfabrik Monitoring Plugins prior to 7.0.0 allows a local attacker controlling the monitoring account to exfiltrate sensitive files such as /etc/shadow by supplying a crafted --filename path to the logfile check plugin, which executes as root via the shipped sudoers allowlist without confining the resolved path to /var/log. The same path-traversal flaw extends to the mysql-logfile and openvpn-client-list plugins. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold access to the monitoring service account (e.g., the nagios or icinga OS user) - matching CVSS PR:L (low privilege). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately captures the threat profile: local attack surface, low privilege requirement (monitoring account), no user interaction, high confidentiality impact, and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised or legitimately holds the nagios or icinga monitoring account invokes the logfile check via the pre-configured sudoers entry: sudo /path/to/logfile --filename=/etc/shadow --warning-regex . with SUPPRESS_OUTPUT not set. … |
| Remediation | Upgrade to Linuxfabrik Monitoring Plugins version 7.0.0, released 2026-08-14, which is the vendor-confirmed fix version per the GitHub release tag and CHANGELOG (https://github.com/Linuxfabrik/monitoring-plugins/releases/tag/v7.0.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today