The vulnerability resides in linuxfabrik‑lib's test helper, where a network‑deployable --test argument is parsed without path confinement. The helper returns the contents of whatever path is supplied, and when executed under a sudo‑whitelisted monitoring plugin this payload can be controlled by the user running the service. An attacker who can manipulate the nagios or icinga account can thus instruct the plugin to read arbitrary files that the root user can read, exposing secrets or configuration data. The flaw demonstrates a path traversal (CWE‑22) and a potential privilege escalation (CWE‑269).

Affected components are Linuxfabrik lib (any version prior to 6.1.0) and Linuxfabrik Monitoring Plugins (any version prior to 7.0.0). A wide range of plugins—including deb‑updates, network‑bonding, and openstack‑swift‑stat—exposed either the test helper or direct read paths, allowing the same disclosure behavior. Version gaps cover many installations that rely on the default packaged releases before the patch.

The CVSS score of 5.5 reflects a moderate impact; the EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the monitoring account and the ability to trigger a plugin that accepts the hidden --test option, so the risk is contextual. Organizations should therefore consider the local attack surface carefully and treat the issue as a low‑volume privilege escalation that can be mitigated by applying the available patch or tightening sudoers.