Hi,

The following vulnerability was published for mrtg.

CVE-2026-72694[0]:
| A flaw was found in MRTG. When the MRTG daemon is started as a root
| user and subsequently drops privileges, a local, low-privileged
| attacker can exploit a symbolic link (symlink) following
| vulnerability. By influencing or pre-placing a symlink in the
| process ID (PID) file path, the attacker can trick the root process
| into changing the ownership of an arbitrary existing file to the
| daemon user. This can lead to local privilege escalation, allowing
| unauthorized access to or modification of sensitive files.

https://bugzilla.redhat.com/show_bug.cgi?id=2460973
Fixed by: https://github.com/oetiker/mrtg/commit/30e19216bfadc0148f347cb0a42fd5e2016e6269


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-72694
https://www.cve.org/CVERecord?id=CVE-2026-72694

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
mrtg, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144393@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Joao Eriberto Mota Filho <eriberto@debian.org> (supplier of updated mrtg package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 17 Aug 2026 20:48:14 -0300
Source: mrtg
Architecture: source
Version: 2.17.10-15
Distribution: unstable
Urgency: medium
Maintainer: Joao Eriberto Mota Filho <eriberto@debian.org>
Changed-By: Joao Eriberto Mota Filho <eriberto@debian.org>
Closes: 1144393
Changes:
 mrtg (2.17.10-15) unstable; urgency=medium
 .
   * debian/control:
       - Bumped compat level to 14.
       - Bumped Standards-Version to 4.7.4.
       - Removed no longer needed "Priority: optional" field.
   * debian/copyright:
       - Converted the last paragraph of the GPL-2+ in a comment.
       - Updated packaging copyright years.
   * debian/patches/110_fix-CVE-2026-72694: created to fix a symlink-following
     chown of pid file in daemon mode. Thanks to Tobias Oetiker
     <tobi@oetiker.ch>. This patch fixes CVE-2026-72694. (Closes: #1144393)
   * debian/watch: migrated to version 5.
Checksums-Sha1:
 6a0155695d97e96831976a95161c67610f3e2ba6 1958 mrtg_2.17.10-15.dsc
 6ddf350af04f31f0e2127867bc11dde2678db540 44204 mrtg_2.17.10-15.debian.tar.xz
 00af2e0b961e71477e113c0cdd89f13d795229aa 8500 mrtg_2.17.10-15_source.buildinfo
Checksums-Sha256:
 129c065dd65db52f4ad70582acd1f7895cd251938ca36d3187b858a020832974 1958 mrtg_2.17.10-15.dsc
 fcb8545dae1f49459ba22e2861a36f2fc2680eda2f6017d5eeb38d4a97a53d89 44204 mrtg_2.17.10-15.debian.tar.xz
 e72902f234ec392539c357664557773acf5ad9722cac9313cd56968ecc589148 8500 mrtg_2.17.10-15_source.buildinfo
Files:
 abc028150e09b22b215601c024bc9e28 1958 net optional mrtg_2.17.10-15.dsc
 3ce84da465489f16a3cbfea2b37afb38 44204 net optional mrtg_2.17.10-15.debian.tar.xz
 19b6e9257f329a16c638ae32e1f3a123 8500 net optional mrtg_2.17.10-15_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEENX3LDuyVoBrrofDS3mO5xwTr6e8FAmqDqyUACgkQ3mO5xwTr
6e9sOA//TwPLx4s9YKjMzr3RQGz9wM9ggaciXhVzkB7W6ynempnoqWY/r4gNYPg6
jOrHaMzNalDhXSR1lHv9PppsznIeZhhfS9gth3qj2PoO1YR9B2iAYYIpaoBR6DJ3
wo/OgwzidIW7F/XRXcMW5eOwjmxk+3GwhdCVBX4tt5H+RGYuuice1gS8ICerqcRV
o8lgjNUDUWxGXTfmdgogJ4VFh10o0aunKmJ2ptVao74g1eijhmcFQrTgrrglsb9z
aPZq8ZeH+ynKjcwJSJ6vby1wYlRUmmJhKNj5uOQhCK+6nsiTnSi4ATZWdf0dilMD
6pXr4pSFcKwD8qMeqrzs8I6RCWRYvlol9JglL69nxOLcvDd4CQ1B9yLgz5klLt+D
mF4XJZj6IjQeNzGSG4JxLV3HaCKWsMcwpqsUzhaCQXaOFVj+MWLCqx70nn+8X6dp
ReCdeVOtzPfrMRmZOXMQ7juE3GQkKYyjhgLLduMZdST7Z86MaotoZHPQZfHrgOyp
XnFGV7RT6P1w3OMjhrECISxR6csEgUe5+axOao2AjCcftgzdz/o9poEZDH05I9uM
kUTCIdM1H+8JmQs8SkYQVA3JAoc1dihj/iFlLB/377/FkdHzKdJYfxvoSzUDVyxk
vQqqp9R3MxeMWcIJno08zx2A/8nPuBGtSHJ4Kt1UUEMUL/kYbGo=
=/kOc
-----END PGP SIGNATURE-----