CVE-2026-53759
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Vulnerability in linuxfabrik-lib before version 4.2.0. The db_sqlite.py module created SQLite databases at predictable paths in /tmp and followed attacker-created symbolic links. An attacker with a local monitoring account can create a symlink and trigger a sudo-authorized plugin, leading to arbitrary path overwrite, denial of service, or manipulation of an existing database. Fixed in version 4.2.0.
Risk Assessment
Risk of privilege escalation and system integrity breach. An attacker may overwrite files, cause unavailability, or manipulate databases.
Recommendation
Update linuxfabrik-lib to version 4.2.0 or later. Restrict access to monitoring accounts and secure the /tmp directory.
Original NVD description (English source)
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monitoring account can create a symlink such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db and then trigger a sudo-authorized plugin, causing the root process to create or modify the symlink target. The primitive can overwrite arbitrary paths, cause denial of service, or manipulate an existing SQLite database through a crafted rollback journal or write-ahead log. The Monitoring Plugins integration also moved plugin caches through lib.db_sqlite.get_db_path() so they use the secured per-user directory. This issue is fixed in version 4.2.0.