CVE-2026-55601

Name of the Vulnerable Software and Affected Versions MultiTail versions prior to 7.1.6

Description The execute-on-match feature, triggered by the -ex and -eX flags, improperly handles matched input by appending it to a configured command within double quotes. The check filter exec() function in mt.c passes this constructed command to execute program() in exec.c, which then executes it via sh -c. Due to partial escaping, shell metacharacters like command substitution remain active, enabling an attacker who can control the monitored input to execute arbitrary commands with the privileges of the user running the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.