Vulnerability-Lookup

CVE-2026-53759 (GCVE-0-2026-53759)

Vulnerability from cvelistv5 – Published: 2026-08-18 20:54 – Updated: 2026-08-21 19:14

Title

linuxfabrik-lib: Insecure creation of SQLite databases

Summary

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monitoring account can create a symlink such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db and then trigger a sudo-authorized plugin, causing the root process to create or modify the symlink target. The primitive can overwrite arbitrary paths, cause denial of service, or manipulate an existing SQLite database through a crafted rollback journal or write-ahead log. The Monitoring Plugins integration also moved plugin caches through lib.db_sqlite.get_db_path() so they use the secured per-user directory. This issue is fixed in version 4.2.0.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 19:14 UTC

CWE

CWE-377 - Insecure Temporary File

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/Linuxfabrik/monitoring-plugins…	x_refsource_CONFIRM
https://github.com/Linuxfabrik/lib/commit/1e3ca61…	x_refsource_MISC
https://github.com/Linuxfabrik/lib/blob/main/CHAN…	x_refsource_MISC
https://github.com/Linuxfabrik/lib/releases/tag/v4.2.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Linuxfabrik	monitoring-plugins	Affected: < 4.2.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53759",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:14:28.252635Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T19:14:49.467Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "monitoring-plugins",
          "vendor": "Linuxfabrik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monitoring account can create a symlink such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db and then trigger a sudo-authorized plugin, causing the root process to create or modify the symlink target. The primitive can overwrite arbitrary paths, cause denial of service, or manipulate an existing SQLite database through a crafted rollback journal or write-ahead log. The Monitoring Plugins integration also moved plugin caches through lib.db_sqlite.get_db_path() so they use the secured per-user directory. This issue is fixed in version 4.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-377",
              "description": "CWE-377: Insecure Temporary File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T20:55:25.382Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4"
        },
        {
          "name": "https://github.com/Linuxfabrik/lib/commit/1e3ca61d45e37ef118aa0c107b420ef74458697e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Linuxfabrik/lib/commit/1e3ca61d45e37ef118aa0c107b420ef74458697e"
        },
        {
          "name": "https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md#v420---2026-06-02",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md#v420---2026-06-02"
        },
        {
          "name": "https://github.com/Linuxfabrik/lib/releases/tag/v4.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Linuxfabrik/lib/releases/tag/v4.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r35r-fpx2-jgr4",
        "discovery": "UNKNOWN"
      },
      "title": "linuxfabrik-lib: Insecure creation of SQLite databases"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53759",
    "datePublished": "2026-08-18T20:54:38.537Z",
    "dateReserved": "2026-06-10T17:48:40.546Z",
    "dateUpdated": "2026-08-21T19:14:49.467Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53759",
      "date": "2026-08-22",
      "epss": "0.00184",
      "percentile": "0.08252"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53759\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-18T21:16:35.880\",\"lastModified\":\"2026-08-21T20:16:37.010\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monitoring account can create a symlink such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db and then trigger a sudo-authorized plugin, causing the root process to create or modify the symlink target. The primitive can overwrite arbitrary paths, cause denial of service, or manipulate an existing SQLite database through a crafted rollback journal or write-ahead log. The Monitoring Plugins integration also moved plugin caches through lib.db_sqlite.get_db_path() so they use the secured per-user directory. This issue is fixed in version 4.2.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Linuxfabrik\",\"product\":\"monitoring-plugins\",\"versions\":[{\"version\":\"\u003c 4.2.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.0,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-21T19:14:28.252635Z\",\"id\":\"CVE-2026-53759\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-377\"}]}],\"references\":[{\"url\":\"https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md#v420---2026-06-02\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Linuxfabrik/lib/commit/1e3ca61d45e37ef118aa0c107b420ef74458697e\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Linuxfabrik/lib/releases/tag/v4.2.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-53759\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-21T19:14:28.252635Z\"}}}], \"references\": [{\"url\": \"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-21T19:14:45.438Z\"}}], \"cna\": {\"title\": \"linuxfabrik-lib: Insecure creation of SQLite databases\", \"source\": {\"advisory\": \"GHSA-r35r-fpx2-jgr4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"Linuxfabrik\", \"product\": \"monitoring-plugins\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 4.2.0\"}]}], \"references\": [{\"url\": \"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4\", \"name\": \"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Linuxfabrik/lib/commit/1e3ca61d45e37ef118aa0c107b420ef74458697e\", \"name\": \"https://github.com/Linuxfabrik/lib/commit/1e3ca61d45e37ef118aa0c107b420ef74458697e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md#v420---2026-06-02\", \"name\": \"https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md#v420---2026-06-02\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Linuxfabrik/lib/releases/tag/v4.2.0\", \"name\": \"https://github.com/Linuxfabrik/lib/releases/tag/v4.2.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monitoring account can create a symlink such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db and then trigger a sudo-authorized plugin, causing the root process to create or modify the symlink target. The primitive can overwrite arbitrary paths, cause denial of service, or manipulate an existing SQLite database through a crafted rollback journal or write-ahead log. The Monitoring Plugins integration also moved plugin caches through lib.db_sqlite.get_db_path() so they use the secured per-user directory. This issue is fixed in version 4.2.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-377\", \"description\": \"CWE-377: Insecure Temporary File\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-18T20:55:25.382Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-53759\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-21T19:14:49.467Z\", \"dateReserved\": \"2026-06-10T17:48:40.546Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-18T20:54:38.537Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-53759

Vulnerability from fkie_nvd - Published: 2026-08-18 21:16 - Updated: 2026-08-21 20:16

Severity

2.0 (Low) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md#v420---2026-06-02
	security-advisories@github.com	https://github.com/Linuxfabrik/lib/commit/1e3ca61d45e37ef118aa0c107b420ef74458697e
	security-advisories@github.com	https://github.com/Linuxfabrik/lib/releases/tag/v4.2.0
	security-advisories@github.com	https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "monitoring-plugins",
          "vendor": "Linuxfabrik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monitoring account can create a symlink such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db and then trigger a sudo-authorized plugin, causing the root process to create or modify the symlink target. The primitive can overwrite arbitrary paths, cause denial of service, or manipulate an existing SQLite database through a crafted rollback journal or write-ahead log. The Monitoring Plugins integration also moved plugin caches through lib.db_sqlite.get_db_path() so they use the secured per-user directory. This issue is fixed in version 4.2.0."
    }
  ],
  "id": "CVE-2026-53759",
  "lastModified": "2026-08-21T20:16:37.010",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.0,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53759",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T19:14:28.252635Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-18T21:16:35.880",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md#v420---2026-06-02"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Linuxfabrik/lib/commit/1e3ca61d45e37ef118aa0c107b420ef74458697e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Linuxfabrik/lib/releases/tag/v4.2.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-377"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-R35R-FPX2-JGR4

Vulnerability from github – Published: 2026-07-06 20:31 – Updated: 2026-07-06 20:31

Summary

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

Details

Summary

The SQLite databases are created at predictable (static) paths in /tmp. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target. This becomes really dangerous for the scripts which can be executed as root with sudo. With this, an attacker can write to abitrary paths.

PoC

The docker-stats check command here as an example. Because writing to /tmp is the default behaviour, the other check commands which use a SQLite database are also very likely affected.

# Create the symlink as nagios user
nagios@test-server:/tmp$ ln -s /root/nagios-was-here /tmp/linuxfabrik-monitoring-plugins-docker-stats.db
# Trigger the execution nagios user
nagios@test-server:/tmp$ sudo /usr/lib64/nagios/plugins/docker-stats

Check whether or not file was created.

root@test-server:/# file /root/nagios-was-here
/root/nagios-was-here: SQLite 3.x database, last written using SQLite version 3046001, file counter 2, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 2

Impact

In it's basic form, this vulnerbility can lead to a denial of service, impacting users who use the provided sudoers file and who didn't take any special precautions like systemd's PrivateTemp. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).

If any application on the server relies on a SQLite database, there are scenarios where this vulnerability allows for content in existing SQLite databases to be modified. An attacker could let the symlink point to an existing SQLite database and create in /tmp a specially-crafted SQLite Rollback Journal (.db-journal) or Write-Ahead-Log (.db-wal), which is then applied to the database.

Fix

A proposed fix would be to create a separate directory inside /tmp per user (e.g.,/tmp/linuxfabrik-monitoring-plugins-{os.geteuid()}). After creating this directory (or using an already existing one), check the following:

# Use os.lstat() instead of os.stat() so we don't accidentally follow symlinks
dir_stat = os.lstat(TMP_DIR_PATH)

# Ensure the directory is a real dir and not a Symlink
if not stat.S_ISDIR(dir_stat.st_mode):
  # abort the execution
  sys.exit(1)

# Verify the owner
if dir_stat.st_uid != os.getuid():
  # abort the execution
  sys.exit(1)

# Verify the permissions
if (dir_stat.st_mode & 0o077) != 0:
  # abort the execution
  sys.exit(1)

Severity

2.0 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "linuxfabrik-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53759"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-377"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T20:31:43Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\nThe SQLite databases are created at predictable (static) paths in `/tmp`. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target.\nThis becomes really dangerous for the scripts which can be executed as root with sudo. With this, an attacker can write to abitrary paths.\n\n### PoC\nThe docker-stats check command here as an example. Because writing to /tmp is the default behaviour, the other check commands which use a SQLite database are also very likely affected.\n```\n# Create the symlink as nagios user\nnagios@test-server:/tmp$ ln -s /root/nagios-was-here /tmp/linuxfabrik-monitoring-plugins-docker-stats.db\n# Trigger the execution nagios user\nnagios@test-server:/tmp$ sudo /usr/lib64/nagios/plugins/docker-stats\n```\nCheck whether or not file was created.\n```\nroot@test-server:/# file /root/nagios-was-here\n/root/nagios-was-here: SQLite 3.x database, last written using SQLite version 3046001, file counter 2, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 2\n```\n\n### Impact\nIn it\u0027s basic form, this vulnerbility can lead to a denial of service, impacting users who use the provided sudoers file and who didn\u0027t take any special precautions like systemd\u0027s `PrivateTemp`. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).\n\nIf any application on the server relies on a SQLite database, there are scenarios where this vulnerability allows for content in existing SQLite databases to be modified. An attacker could let the symlink point to an existing SQLite database and create in /tmp a specially-crafted SQLite Rollback Journal (`.db-journal`) or Write-Ahead-Log (`.db-wal`), which is then applied to the database.\n\n### Fix\nA proposed fix would be to create a separate directory inside /tmp per user (e.g.,` /tmp/linuxfabrik-monitoring-plugins-{os.geteuid()}`). After creating this directory (or using an already existing one), check the following:\n```\n# Use os.lstat() instead of os.stat() so we don\u0027t accidentally follow symlinks\ndir_stat = os.lstat(TMP_DIR_PATH)\n\n# Ensure the directory is a real dir and not a Symlink\nif not stat.S_ISDIR(dir_stat.st_mode):\n  # abort the execution\n  sys.exit(1)\n\n# Verify the owner\nif dir_stat.st_uid != os.getuid():\n  # abort the execution\n  sys.exit(1)\n\n# Verify the permissions\nif (dir_stat.st_mode \u0026 0o077) != 0:\n  # abort the execution\n  sys.exit(1)\n```",
  "id": "GHSA-r35r-fpx2-jgr4",
  "modified": "2026-07-06T20:31:43Z",
  "published": "2026-07-06T20:31:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Linuxfabrik/monitoring-plugins"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases"
}

PYSEC-2026-2596

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:04

Details

Summary

PoC

The docker-stats check command here as an example. Because writing to /tmp is the default behaviour, the other check commands which use a SQLite database are also very likely affected.

# Create the symlink as nagios user
nagios@test-server:/tmp$ ln -s /root/nagios-was-here /tmp/linuxfabrik-monitoring-plugins-docker-stats.db
# Trigger the execution nagios user
nagios@test-server:/tmp$ sudo /usr/lib64/nagios/plugins/docker-stats

Check whether or not file was created.

root@test-server:/# file /root/nagios-was-here
/root/nagios-was-here: SQLite 3.x database, last written using SQLite version 3046001, file counter 2, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 2

Impact

Fix

# Use os.lstat() instead of os.stat() so we don't accidentally follow symlinks
dir_stat = os.lstat(TMP_DIR_PATH)

# Ensure the directory is a real dir and not a Symlink
if not stat.S_ISDIR(dir_stat.st_mode):
  # abort the execution
  sys.exit(1)

# Verify the owner
if dir_stat.st_uid != os.getuid():
  # abort the execution
  sys.exit(1)

# Verify the permissions
if (dir_stat.st_mode & 0o077) != 0:
  # abort the execution
  sys.exit(1)

Severity

2.0 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Impacted products

Name	purl
linuxfabrik-lib	pkg:pypi/linuxfabrik-lib

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "linuxfabrik-lib",
        "purl": "pkg:pypi/linuxfabrik-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0.0",
        "2.0.0.7",
        "2.1.0.0",
        "2.1.0.4",
        "2.1.1.15",
        "2.1.1.5",
        "2.1.1.7",
        "2.2.0",
        "2.2.1",
        "2.3.0",
        "2.4.0",
        "3.0.0",
        "3.1.0",
        "3.1.1",
        "3.2.0",
        "3.3.0",
        "3.4.0",
        "3.4.1",
        "4.0.0",
        "4.0.1",
        "4.0.2",
        "4.1.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53759",
    "GHSA-r35r-fpx2-jgr4"
  ],
  "details": "### Summary\nThe SQLite databases are created at predictable (static) paths in `/tmp`. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target.\nThis becomes really dangerous for the scripts which can be executed as root with sudo. With this, an attacker can write to abitrary paths.\n\n### PoC\nThe docker-stats check command here as an example. Because writing to /tmp is the default behaviour, the other check commands which use a SQLite database are also very likely affected.\n```\n# Create the symlink as nagios user\nnagios@test-server:/tmp$ ln -s /root/nagios-was-here /tmp/linuxfabrik-monitoring-plugins-docker-stats.db\n# Trigger the execution nagios user\nnagios@test-server:/tmp$ sudo /usr/lib64/nagios/plugins/docker-stats\n```\nCheck whether or not file was created.\n```\nroot@test-server:/# file /root/nagios-was-here\n/root/nagios-was-here: SQLite 3.x database, last written using SQLite version 3046001, file counter 2, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 2\n```\n\n### Impact\nIn it\u0027s basic form, this vulnerbility can lead to a denial of service, impacting users who use the provided sudoers file and who didn\u0027t take any special precautions like systemd\u0027s `PrivateTemp`. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).\n\nIf any application on the server relies on a SQLite database, there are scenarios where this vulnerability allows for content in existing SQLite databases to be modified. An attacker could let the symlink point to an existing SQLite database and create in /tmp a specially-crafted SQLite Rollback Journal (`.db-journal`) or Write-Ahead-Log (`.db-wal`), which is then applied to the database.\n\n### Fix\nA proposed fix would be to create a separate directory inside /tmp per user (e.g.,` /tmp/linuxfabrik-monitoring-plugins-{os.geteuid()}`). After creating this directory (or using an already existing one), check the following:\n```\n# Use os.lstat() instead of os.stat() so we don\u0027t accidentally follow symlinks\ndir_stat = os.lstat(TMP_DIR_PATH)\n\n# Ensure the directory is a real dir and not a Symlink\nif not stat.S_ISDIR(dir_stat.st_mode):\n  # abort the execution\n  sys.exit(1)\n\n# Verify the owner\nif dir_stat.st_uid != os.getuid():\n  # abort the execution\n  sys.exit(1)\n\n# Verify the permissions\nif (dir_stat.st_mode \u0026 0o077) != 0:\n  # abort the execution\n  sys.exit(1)\n```",
  "id": "PYSEC-2026-2596",
  "modified": "2026-07-13T16:04:36.177155Z",
  "published": "2026-07-13T15:46:28.436408Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Linuxfabrik/monitoring-plugins"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/linuxfabrik-lib"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-r35r-fpx2-jgr4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53759"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-53759 (GCVE-0-2026-53759)

FKIE_CVE-2026-53759

GHSA-R35R-FPX2-JGR4

Summary

PoC

Impact

Fix

PYSEC-2026-2596

Summary

PoC

Impact

Fix

Tags

Sightings

Nomenclature