The Linuxfabrik monitoring-plugins package, used for Icinga, Nagios, and related systems, has a CWE-22 path traversal vulnerability in the logfile check plugin prior to version 7.0.0. The plugin accepts a --filename parameter that is opened as root without confinement to /var/log. This allows an attacker with monitoring account privileges to specify arbitrary root-readable files (e.g., /etc/shadow) and have their contents read and returned. The vulnerability arises because the expanded scan_path is passed directly to open() without real-path containment or allowlist checks. The fix in version 7.0.0 confines paths to documented log roots and resolves symlinks and parent-directory traversal before checking containment.

An attacker with control over the monitoring account can exploit this vulnerability to read arbitrary root-readable files on the system, potentially exposing sensitive information such as password hashes from /etc/shadow. The vulnerability does not allow modification or denial of service but compromises confidentiality.

Upgrade to Linuxfabrik monitoring-plugins version 7.0.0 or later, where this path traversal vulnerability is fixed by restricting file paths to allowed log directories and resolving symlinks and traversal sequences before file access. No other mitigations are indicated.