Marked for autoremoval on 27 September: #1144393high
Version 2.17.10-14 of mrtg is marked for autoremoval from testing on Sun 27 Sep 2026. It is affected by #1144393. The removal of mrtg will also cause the removal of (transitive) reverse dependency: mrtg-ping-probe. You should try to prevent the removal by fixing these RC bugs.
CVE-2026-72694:
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
CVE-2026-72694:
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
CVE-2026-72694:
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
Depends on packages which need a new maintainer
normal
The packages that mrtg depends on which need a new maintainer are:
Among the 10 debian patches
available in version 2.17.10-16 of the package,
we noticed the following issues:
3 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/m/mrtg.png){kind=link}