Executive brief
A vulnerability in the Linuxfabrik Monitoring Plugins library allows local attackers to manipulate files on the system. The software creates temporary database files in a predictable location, which can be redirected by a malicious user to overwrite or corrupt other important files. This could lead to a service outage or unauthorized modification of data, especially if the monitoring tools are configured to run with administrative privileges.
Technical details
The vulnerability is an insecure temporary file creation (CWE-377) within the linuxfabrik-lib library used by various monitoring plugins. The software creates SQLite databases at predictable static paths in the /tmp directory without verifying if the path is already a symbolic link. A local attacker can create a symlink at these paths pointing to a target file; when the plugin runs (potentially with elevated privileges via sudo), it follows the symlink and writes its database content to the target. This can result in arbitrary file overwrites, denial of service, or corruption of existing SQLite databases via journal/WAL file manipulation. The issue is fixed in version 4.2.0 by implementing per-user temporary directories with strict ownership and permission checks.
Affected products
- Linuxfabrik linuxfabrik-lib < 4.2.0
Timeline
- 2026-06-02: disclosed: Initial disclosure to Linuxfabrik
- 2026-07-06: advisory: GitHub Advisory published
- 2026-07-06: patched: Fix released in version 4.2.0