Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
Historical advisory recorded 28 Oct 2026 23:55:13 UTC. Read the latest advisory.
cve-program · CVE-2026-72694
PublishedA flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-72694
PublishedMrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
- Source published
- 11 Aug 2026 08:37:55 UTC
- Source modified
- 28 Oct 2026 22:05:04 UTC
- Saved here
- 28 Oct 2026 23:55:13 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N