Privilege Escalation via Symlink in MRTG

Executive Summary

CVE-2026-72694 is a symlink-following vulnerability in MRTG (Multi Router Traffic Grapher). When MRTG starts as root and then drops privileges, a local attacker can pre-place a symlink in the PID file path. This tricks the root process into changing ownership of an arbitrary file to the daemon user, enabling local privilege escalation and unauthorized access or modification of sensitive files.

Useful 0 Not Useful 0

Detection Guidance

Check if MRTG is running as root with the --daemon option by running ps aux | grep mrtg. Inspect PID file locations for symlinks using ls -l /path/to/pidfile. Verify if unprivileged users can write to directories containing PID files with ls -ld /path/to/directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker with low privileges to escalate their access to root-level permissions. They could then modify or access sensitive files, potentially leading to data breaches, system compromise, or unauthorized system changes. The impact depends on the files targeted and system configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance risks include legal penalties, data breach notifications, and reputational damage due to compromised protected health or personal information.

Useful 0 Not Useful 0

Mitigation Strategies

Do not start MRTG as root with --daemon. Run it as an unprivileged user instead. If root startup is required, ensure PID file and directory are owned by root and not writable by unprivileged users. Prevent untrusted users from influencing the --pid-file path.

Useful 0 Not Useful 0