The vulnerability originates in linuxfabrik-lib’s SQLite database helper, which creates databases at predictable paths in the shared /tmp directory, following any symbolic links placed there. An attacker controlling a local monitoring account can create a symbolic link such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db, then trigger a plugin that runs with sudo privileges. The root process will then create or modify the symlink target, potentially overwriting arbitrary files, causing denial of service, or tampering with SQLite databases via a crafted rollback journal or write‑ahead log. The issue was fixed by moving plugin caches to per‑user secure directories in library version 4.2.0.

Linuxfabrik’s monitoring‑plugins package is affected in all releases prior to version 4.2.0. Users running older versions of the library that provide SQLite database access are at risk.

The CVSS score of 2 reflects a low severity assessment under current scoring. EPSS data is unavailable, so the exhibit does not indicate a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to a monitoring account and the ability to execute plugins with sudo permissions. The attacker can manipulate file ownership and content at root level by leveraging the predictable database paths and the symlink following behavior.