CVE-2026-55601 Details
Description
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.
A shell injection vulnerability has been identified in MultiTail versions through 7.1.5. The issue arises in the execute-on-match feature, where matched input is appended to a command and executed via the shell. This partial escaping of input allows for the injection of shell metacharacters, such as command substitution, enabling execution of arbitrary commands as the user running MultiTail.
Users can update to MultiTail version 7.1.6, which addresses the vulnerability by changing how matched input is handled. The updated version requires users to explicitly reference the matched text using the MULTITAIL_MATCH environment variable.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/folkertvanheusden/multitail/security/advisories/GHSA-54vm-wwx8-856h | CISA-ADP | AdvisoryExploitVendor |
| https://github.com/folkertvanheusden/multitail/commit/84f304e140261034e33796bab81e9bf4f09d153c | [email protected] | Source CodeVendor |
| https://github.com/folkertvanheusden/multitail/issues/56 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/folkertvanheusden/multitail/security/advisories/GHSA-54vm-wwx8-856h | [email protected] | AdvisoryExploitVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MultiTail | <= 7.1.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |