Root code execution via site-writable library path

Privilege escalation in Checkmk 2.2.0p10 through 2.2.0p16 allows local users with site access to execute code as root. The agent passes a site-controlled library directory through LD_LIBRARY_PATH when root invokes unixcat, allowing a malicious shared library in that writable directory to be loaded. A Checkmk site account with permission to write the site library directory is required, and successful exploitation grants root-level code execution on the monitoring server.