CVE-2026-55601
In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.
- CVSS 3.1
- 7.3 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.21% probability · 12th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Source
- security-advisories@github.com
EPSS moved from 0.2% on 14 October 2026 to 0.2% on 26 October 2026.
References
- https://github.com/folkertvanheusden/multitail/commit/84f304e140261034e33796bab81e9bf4f09d153c
- https://github.com/folkertvanheusden/multitail/issues/56
- https://github.com/folkertvanheusden/multitail/security/advisories/GHSA-54vm-wwx8-856h
- https://github.com/folkertvanheusden/multitail/security/advisories/GHSA-54vm-wwx8-856h
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.