CVE-2026-53759

Received Received - Intake

linuxfabrik-lib SQLite Symlink Arbitrary File Overwrite

Publication date: 2026-08-18

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monitoring account can create a symlink such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db and then trigger a sudo-authorized plugin, causing the root process to create or modify the symlink target. The primitive can overwrite arbitrary paths, cause denial of service, or manipulate an existing SQLite database through a crafted rollback journal or write-ahead log. The Monitoring Plugins integration also moved plugin caches through lib.db_sqlite.get_db_path() so they use the secured per-user directory. This issue is fixed in version 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-53759

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfabrik	lib	to 4.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Attack-Flow Graph

Executive Summary

This vulnerability exists in linuxfabrik-lib versions prior to 4.2.0. The db_sqlite.py module creates SQLite databases in the shared /tmp directory at predictable paths. Attackers with local monitoring account access can create symbolic links at these paths. When a sudo-authorized plugin is triggered, it follows these symlinks, allowing the attacker to overwrite arbitrary files, cause denial of service, or manipulate existing SQLite databases through crafted journal or log files.

Detection Guidance

Check for the presence of the vulnerable db_sqlite.py file in the linuxfabrik-lib package, particularly versions prior to 4.2.0. Inspect /tmp for symlinks or unexpected SQLite database files created by monitoring plugins. Review sudo-authorized plugin execution logs for unusual file operations in /tmp.

Impact Analysis

If exploited, this vulnerability could allow an attacker to overwrite critical system files, disrupt services by causing denial of service, or corrupt existing databases. Since the attack requires local monitoring account access, the impact is limited to systems where such access is possible. However, successful exploitation could lead to system instability or data loss.

Compliance Impact

This vulnerability primarily affects integrity and availability of data processed by the affected system. It could lead to unauthorized data modification or denial of service, which may violate compliance requirements for GDPR (data integrity and availability) and HIPAA (integrity and availability of protected health information). The impact depends on whether the compromised system handles regulated data.

Mitigation Strategies

Upgrade linuxfabrik-lib to version 4.2.0 or later. Remove any existing symlinks or unexpected files in /tmp related to linuxfabrik-monitoring-plugins. Restrict write permissions to /tmp for monitoring accounts. Audit sudo-authorized plugin configurations to prevent unauthorized file operations.

Hi! I’m here to help you understand CVE-2026-53759. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70