Executive brief
MRTG (Multi Router Traffic Grapher) is a network monitoring tool used to track traffic on network connections. When the MRTG daemon starts as root and drops privileges, a local attacker can exploit a symlink vulnerability in the PID file path to trick the daemon into changing ownership of arbitrary files, potentially gaining unauthorized access to or modifying sensitive system files.
Technical details
This vulnerability is a symlink-following flaw (CWE-59) in MRTG's PID file handling. When the daemon is started as root and subsequently drops privileges, an unprivileged local attacker can pre-place or influence a symlink in the PID file path. By doing so, the attacker can cause the root-privileged process to perform a chown operation on an arbitrary existing file, changing its ownership to the daemon user. Attack preconditions include local access to the system and the ability to manipulate the PID file path. This allows a low-privileged local attacker to escalate privileges and gain unauthorized access or modification capabilities. A patch is available in MRTG version 2.17.10-12.el10_2.1 and later for Red Hat Enterprise Linux 10.
Affected products
- MRTG Project MRTG prior to 2.17.10-12.el10_2.1
Timeline
- 2026-08-11: disclosed
- 2026-08-20: patched