CVE-2026-55601

Deferred Deferred - Pending Action

MultiTail Command Injection via Log File Monitoring

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55601

EUVD

EUVD-2026-100521

Affected Vendors & Products

Vendor	Product	Version / Range
folkertvanheusden	multitail	<= 7.1.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-55601 is a shell injection vulnerability in MultiTail versions 7.1.5 and earlier. The issue occurs in the -ex and -eX features, where attacker-controlled input is appended to a command inside double quotes. Partial escaping leaves shell metacharacters like command substitution ($()) active, allowing command execution as the user running MultiTail.

Detection Guidance

Check if MultiTail versions 7.1.5 or earlier are installed using 'multitail --version'. If installed, verify if the -ex or -eX features are enabled in running instances by inspecting process commands with 'ps aux | grep multitail'. Monitor logs for suspicious command execution patterns or unexpected shell metacharacters in monitored files.

Impact Analysis

An attacker who can influence monitored input could execute arbitrary commands on your system with the privileges of the user running MultiTail. This could lead to data theft, system compromise, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered due to command execution.

Mitigation Strategies

Immediately disable the -ex and -eX features in MultiTail. Avoid using MultiTail for monitoring untrusted input until a patch is available. If monitoring is critical, consider alternative tools like tail, less, or journalctl with safer command execution methods.

Hi! I’m here to help you understand CVE-2026-55601. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70