The flaw resides in the Linuxfabrik monitoring-plugins logfile checker, which accepts a free‑form --filename argument and opens the resulting file as root whenever the plugin is run through the shipped Nagios or Icinga sudoers allowlist. Because the resolved path is not confined to the intended log directory, an attacker who can control the monitoring account is able to specify any root‑readable file, such as /etc/shadow, and cause its contents to be returned as part of the plugin’s output. The vulnerability therefore allows read access to arbitrary files that belong to root, exposing highly sensitive data and potentially facilitating further compromise.

Any installation of the Linuxfabrik monitoring-plugins package that predates version 7.0.0 is affected. The vulnerability is contained within the check-plugins/logfile/logfile script used by Nagios, Icinga and related monitoring frameworks. The issue is fixed in the 7.0.0 release by restricting log file paths, resolving symlinks, and enforcing an allowlist for known log directories.

The CVSS score of 5.5 indicates moderate severity, and no EPSS data are available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to run the vulnerable plugin via the monitoring system’s authorized sudoers entry, implying that the attacker already has control over the monitoring account or can inject commands through that channel. Thus the risk is primarily local, relying on a state of elevated privilege granted by the monitoring framework, rather than remote exploitation.