The vulnerability resides in the logfile check legacy database migration of Linuxfabrik monitoring‑plugins. When migrating the log file database, the code moves a predictable path from the /tmp directory using os.rename() and then opens the resulting SQLite database with sqlite3.connect(). If a local user who controls the plugin’s account places a symbolic link at the expected database location, the subsequent database connection will follow that link. This allows the user to cause the plugin to read from or write to arbitrary files that the link points to, potentially altering data used by monitoring systems or exposing sensitive information. The issue reflects a path manipulation weakness (CWE‑367) and an unsafe symlink follow (CWE‑59).

Linuxfabrik monitoring‑plugins version 6.0.0 is affected. Operators using this version for Icinga, Nagios, or similar monitoring systems should verify the plugin version and upgrade if necessary. No other vendors or products are directly listed as impacted.

The CVSS base score of 5.8 indicates a medium rating with the potential for local privilege escalation or data tampering. The EPSS score of <1% suggests a very low probability of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The likely attack vector is a local user with access to the plugin account; by creating a malicious symlink in the predictable path, the user can influence the database operations performed during a root‑run check.