CVE-2026-73973

Received Received - Intake

Path Traversal in Linuxfabrik Monitoring Plugins

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confining the resolved path to /var/log. An attacker who controls the monitoring account can select a root-readable file such as /etc/shadow and use --warning-regex . while leaving SUPPRESS_OUTPUT false, causing each nonempty line to be collected in warn_matches and returned through lib.base.oao(). The vulnerable flow passes the expanded scan_path directly to open(), and neither real-path containment nor an allowlist protects the sink. The same fix also confines mysql-logfile and openvpn-client-list paths, allows only documented log roots, and resolves symlinks and parent-directory traversal before checking containment. This issue is fixed in version 7.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-73973

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfabrik	monitoring_plugins	to 7.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects Linuxfabrik Monitoring Plugins, which provides monitoring tools for Icinga and Nagios. The issue is in the check-plugins/logfile component before version 7.0.0. It allows an attacker with access to the monitoring account to read arbitrary root-owned files by exploiting improper path handling. The plugin accepts a free-form file path and opens it as root without restricting the path to /var/log. An attacker can specify a sensitive file like /etc/shadow and use a regex to collect its contents.

Detection Guidance

Check if the installed version of Linuxfabrik Monitoring Plugins is below 7.0.0. Run: check_plugins_version --version or rpm -qa | grep linuxfabrik-monitoring-plugins. Inspect sudoers configuration for monitoring accounts to see if they allow unrestricted file access.

Impact Analysis

If you use Linuxfabrik Monitoring Plugins versions before 7.0.0, an attacker with access to the monitoring account could read sensitive system files such as /etc/shadow or other root-owned files. This could lead to information disclosure, privilege escalation, or further attacks on the system. The impact is limited to systems where the vulnerable plugin is installed and the monitoring account is compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Unauthorized access to files like /etc/shadow or other sensitive data could result in data breaches, leading to legal penalties, fines, or reputational damage for organizations subject to these regulations.

Mitigation Strategies

Upgrade to version 7.0.0 or later immediately. Review and restrict sudoers allowlist for monitoring accounts to only permitted paths. Audit all plugins using --filename for potential misuse.

Hi! I’m here to help you understand CVE-2026-73973. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70