CVE-2026-55601: MultiTail: Shell injection in execute-on-match command handling
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec() in mt.c passed the constructed command through executeprogram() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users running MultiTail with the -ex or -eX execute-on-match feature configured are exposed if an attacker can influence the monitored input that matches the configured rule. Commands run with the privileges of the user running MultiTail.
What does an attacker need to exploit this issue?
The attacker needs to control or inject content into a monitored log or other input such that it is matched by an execute-on-match rule. Shell metacharacters in that matched content can remain active when MultiTail passes the constructed command to sh -c.
What can be done if patching is not immediately possible?
Disable or avoid the -ex and -eX execute-on-match features for inputs that may be influenced by untrusted parties. Restrict who can write to monitored logs or otherwise control monitored input.
How can I determine whether my deployment is affected?
Check whether MultiTail is version 7.1.5 or earlier and whether it is launched or configured with -ex or -eX rules. Review the sources being monitored to determine whether untrusted users or systems can cause matching content to appear.
Is a fixed release available?
No fixed release was available as of the review described in the advisory data.