The vulnerability occurs in the execute-on-match feature of MultiTail. In versions 7.1.5 and earlier, the -ex and -eX options append attacker‑controlled matched input to a configured command inside double quotes and pass the resulting string to the system shell via sh -c. Partial escaping leaves shell metacharacters such as command substitution active, enabling an attacker who can influence the monitored input to execute arbitrary commands as the user running MultiTail. This flaw is a classic command injection and is identified as CWE‑78.

The affected product is MultiTail by folkertvanheusden. Versions 7.1.5 and earlier are impacted; no fixed release is available at the time of this review.

The CVSS score of 7.3 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is a local attacker who can influence the content of the log files being monitored – for example by injecting controlled data into the log. Once the attacker can inject matching input, the shell injection allows execution of arbitrary commands with the permissions of the MultiTail process. Given the absence of a patch, remediation relies on mitigating the potential exploitation path rather than eliminating the flaw.