MRTG PID file symlink

Summaryinfo

A vulnerability classified as problematic was found in MRTG. Affected is an unknown function of the component PID file Handler. Executing a manipulation can lead to symlink. The identification of this vulnerability is CVE-2026-72694. The attack can only be executed locally. There is no exploit available.

Detailsinfo

A vulnerability was found in MRTG (version unknown). It has been declared as problematic. This vulnerability affects an unknown function of the component PID file Handler. The manipulation with an unknown input leads to a symlink vulnerability. The CWE definition for the vulnerability is CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.

This vulnerability was named CVE-2026-72694. The exploitation appears to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 339118 (Oracle Linux 10 : mrtg (ELSA-2026-57596)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (339118). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• MRTG

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion