CVE-2026-73973

Name of the Vulnerable Software and Affected Versions Linuxfabrik Monitoring Plugins versions prior to 7.0.0

Description The check-plugins/logfile/logfile plugin accepts a free-form --filename path and opens it with root privileges when invoked via the provided nagios or icinga sudoers allowlist. The system fails to confine the resolved path to the /var/log directory. An attacker with control over the monitoring account can specify a root-readable file, such as /etc/shadow, and use the --warning-regex parameter with a dot . while keeping SUPPRESS OUTPUT set to false. This process causes nonempty lines of the file to be collected in warn matches and returned through the lib.base.oao() function. The vulnerability exists because the expanded scan path is passed directly to the open() function without real-path containment or an allowlist to protect the sink. Similar issues affect mysql-logfile and openvpn-client-list paths.

Recommendations Update to version 7.0.0. As a temporary workaround, restrict the use of the --filename parameter in the check-plugins/logfile/logfile plugin to prevent unauthorized file access.