EUVD-2026-100521Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInject crafted entry into monitored log
-
DeliveryLine matches configured -ex/-eX filter
-
ExploitMatched text appended inside sh -c command
-
ExecutionCommand substitution bypasses partial escaping
-
ImpactArbitrary code runs as MultiTail user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the operator has explicitly enabled the non-default -ex or -eX execute-on-match feature with a configured command and matching filter - this is the precise prerequisite, not generic 'configuration'. The attacker must then be able to inject content into a source monitored by MultiTail such that the injected line matches the configured filter regex; matched text containing shell metacharacters (notably command substitution via $(...) or backticks, which the partial escaping in check_filter_exec() fails to neutralize) is passed through execute_program() to sh -c. Limiting factors: the execute-on-match feature is off by default and must be deliberately configured; exploitation requires write influence over the monitored input (CVSS AV:L, so typically local/log-source access); impact is bounded by the privileges of the user running MultiTail (S:U, no privilege escalation beyond that user). |
| Impact | Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R) describes a locally-scoped, operator-dependent flaw with total technical impact (C:H/I:H/A:H), matching the SSVC assessment of Exploitation=poc, Automatable=no, Technical Impact=total. SSVC reports a proof-of-concept exists but the issue is NOT in CISA KEV and there is no evidence of active exploitation - this is 'publicly available exploit code exists', not in-the-wild abuse. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The key risk-limiting factor is that exploitation is entirely gated on the victim having enabled the non-default -ex/-eX execute-on-match feature with a command and filter; without that configuration the code path is never reached. Combined with low real-world deployment of MultiTail, this is a legitimately-fixable local command-injection bug but a lower operational priority than its 7.3 score suggests for most environments. Note the input states 'No fixed release is available', yet a fix commit (84f304e, switching to the MULTITAIL_MATCH environment variable) already exists in the upstream repository - so a patch is available at source level even though no tagged release has shipped; verify with the maintainer before relying on a packaged version. |
| Exploit ScenarioDerived | An operator runs MultiTail with the -ex/-eX execute-on-match feature configured to run a command when log lines match a filter. An attacker who can write to one of the monitored log sources injects a line containing shell command substitution (e.g. $(...) or backticks); because escaping is only partial, the payload is passed to sh -c and executes as the user running MultiTail. A proof-of-concept is reported (SSVC Exploitation=poc), but there is no evidence of active exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Command injection in MultiTail 7.1.5 and earlier lets an attacker who can write content into a monitored log or stream execute arbitrary shell commands as the user running MultiTail, because matched text is concatenated into a command passed to sh -c with only partial escaping. Exploitation is gated by a deliberate, non-default configuration: the operator must have enabled the -ex/-eX execute-on-match feature with a filter regex, and the injected line must match that regex; because the CVSS vector is AV:L/PR:L/UI:R, this is a local, low-privileged, user-interaction-dependent issue with impact bounded by the privileges of the MultiTail process. Exploitation code is publicly available (CISA SSVC reports Exploitation: poc), but there is no evidence of confirmed active exploitation, and the assessed risk is moderate and internally consistent rather than alarming.
RemediationAI
No fixed release is available as of this review: MultiTail 7.1.5 remains the latest published version and the description confirms 'No fixed release is available as of this review,' so the only vendor-side fix is the upstream commit 84f304e140261034e33796bab81e9bf4f09d153c (see advisory GHSA-54vm-wwx8-856h at https://github.com/folkertvanheusden/multitail/security/advisories/GHSA-54vm-wwx8-856h and issue 56), which is an un-tagged upstream fix rather than a released patched version. Teams that build MultiTail from source should rebuild from that commit or later and migrate execute-on-match commands to read the matched text from the $MULTITAIL_MATCH environment variable rather than relying on the appended, quoted argument; commands written for the old behaviour will need updating, which is the main compatibility cost. Where rebuilding is not possible, the most effective control is to stop using -ex/-eX entirely - the feature is off by default, so simply removing the option from MultiTail invocations eliminates the injection path, at the cost of losing automated match-triggered actions. If the feature must be kept, harden the inputs it consumes: remove write access for untrusted principals to every file, FIFO, or stream MultiTail is configured to monitor (this directly addresses the attacker-write-influence prerequisite), avoid tailing attacker-controllable sources such as web server access logs, auth logs, or application logs that reflect user input, and run MultiTail under a dedicated low-privilege account (its own user, no sudo, restricted filesystem and network reachability) so that any successful injection is contained to that account - noting this only limits blast radius, it does not remove the flaw. Operators should also avoid configuring filter regexes so broad that ordinary attacker-influenced lines will match them. Detection-wise, audit existing MultiTail command lines for -ex/-eX and inspect configured commands for any dependence on the appended quoted argument, since those are the exact configurations exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78 (OS Command Injection) in MultiTail's execute-on-match path. In the vulnerable code, check_filter_exec() in mt.c built a command string by appending the attacker-influenced matching_string to the operator-supplied command inside double quotes, prefixing with a backslash only the characters '"' and '`'. That partial escaping left other shell expansion forms live - most importantly command substitution via $(...), plus other $-based expansions - so a matched line such as one containing $(id) would be evaluated by the shell. The constructed string was handed to execute_program() in exec.c, which ultimately invokes sh -c, giving the injected command the full privileges of the MultiTail process. The upstream fix in commit 84f304e140261034e33796bab81e9bf4f09d153c refactors execute_program() into execute_program_impl() and adds execute_program_with_match(), which exports the matched text through the MULTITAIL_MATCH environment variable (setenv) instead of splicing it into the shell command line; mt.c now calls execute_program_with_match(cmd, 1, matching_string) and users reference the match as $MULTITAIL_MATCH. This converts attacker-controlled data from shell syntax into inert environment data. The affected surface is the log-monitoring pipeline (tail/stream sources read by MultiTail), and the CPE data available covers MultiTail builds up to and including 7.1.5 across Linux/Unix platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Config-gated local flaw requiring the operator to enable -ex/-eX (UI:R) and attacker write access to a monitored source (PR:L, AV:L); full code execution as the user yields C/I/A:H with no scope change.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.
Technical POC Analysis
CWE-78 (OS Command Injection).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
MultiTail, a log-monitoring utility commonly used by operations and administration teams, is affected in versions 7.1.5 and earlier by a command-injection flaw that can allow a local, low-privileged user with write access to a monitored log or stream to run arbitrary commands under the account executing MultiTail. The attack path is gated by a deliberate, non-default execute-on-match configuration and requires user interaction, so exposure is limited to teams that have enabled that feature. Because MultiTail is often run with elevated privileges to read system logs, leadership should treat the issue as a privilege-management and configuration-hygiene risk that warrants immediate hardening rather than an enterprise-wide emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the -ex/-eX execute-on-match feature and any associated filter regex; restrict write access to monitored logs and streams to trusted accounts; run MultiTail under a least-privileged service account; avoid running MultiTail as root; monitor project release channels for a patched version and apply it when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB