CVE-2026-55601

7.3High

Published 13 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.3High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Attackers who can write to monitored log files can execute arbitrary shell commands as the user running MultiTail. This requires a local user to run MultiTail with execute-on-match flags against attacker-influenced input.

Root cause

The check_filter_exec() function incompletely escapes matched log input before passing it to sh -c via double quotes, leaving shell metacharacters active.

Affected systems

MultiTail version 7.1.5 and earlier

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

No fixed release is currently available. Mitigate immediately by not running MultiTail with the -ex or -eX options on untrusted log sources.

shell

$ multitail -V

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55601