CVE-2026-73974: Local Path Traversal and Privilege Escalation in Linuxfabrik Monitoring Plugins

Vulnerability ID: CVE-2026-73974
CVSS Score: 5.5
Published: 2026-08-18

CVE-2026-73974 is a local path traversal vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins. Under standard monitoring configurations running with elevated privileges via sudo, this flaw can be exploited by an unprivileged local user to read arbitrary root-only files, resulting in local privilege escalation.

TL;DR

A local path traversal flaw in the testing parameters of Linuxfabrik Monitoring Plugins allows unprivileged users to read sensitive files as root.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22 / CWE-269
Attack Vector: Local
CVSS: 5.5
EPSS: N/A
Impact: Local Privilege Escalation
Exploit Status: PoC
KEV Status: Not Listed

Affected Systems

linuxfabrik-lib
Linuxfabrik Monitoring Plugins
linuxfabrik-lib: < 6.1.0 (Fixed in: 6.1.0)
monitoring-plugins: < 7.0.0 (Fixed in: 7.0.0)

Code Analysis

Commit: d665042

db_sqlite.py: get_db_path() rejects a database filename that is not a plain basename; lftest.py: confine --test fixture reads to /unit-test/

Commit: f6680a9

Update monitoring plugins to route internal --test argument safely through patched lftest library function.

Mitigation Strategies

Upgrade linuxfabrik-lib to version 6.1.0 or 6.0.1
Upgrade Linuxfabrik Monitoring Plugins to version 7.0.0
Restrict sudo wildcard permissions and audit execution of monitoring scripts

Remediation Steps:

Identify all installations of Linuxfabrik Monitoring Plugins and the shared linuxfabrik-lib library.
Apply the updates to linuxfabrik-lib version 6.1.0 or 6.0.1.
Apply the updates to Linuxfabrik Monitoring Plugins version 7.0.0.
Review /etc/sudoers to ensure monitoring service accounts only have necessary and specific access rights.