Read the docs
TI-2025-11882 Aliases CVE-2025-12972GHSA-mjmc-4hm9-g39m

Path traversal in FluentBit Fluent Bit

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00931 60th percentileScored 2026-11-07
Fix Fixed Fluent Bit (FluentBit): 4.0.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FluentBitFluent Bitbefore 4.0.124.0.12Patch availableCNA
  • Fluent Bit VendorFluentBit Affected before 4.0.12 Fixed in 4.0.12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableFluentBit
  • cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·FluentBit

Remediation

  • Fix · CNA Fluent Bit (FluentBit) Fixed in 4.0.12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FluentBit Fluent Bit 4.0.12

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-11887 Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize…Priority MEDIUM 47
    • TI-2025-11880 Buffer overflow in FluentBit Fluent BitPriority MEDIUM 42
    • TI-2025-11888 Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the…Priority LOW 25
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12972
  2. 2026-10-03 Alias added: GHSA-mjmc-4hm9-g39m

References

Other 2

  • TI-2024-17419 fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c. CVSS 3.1HIGH 7.5
  • TI-2024-15728 In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an… CVSS 3.1HIGH 7.5
  • TI-2024-04026 Fluent Bit Memory Corruption Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2021-21547 An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to… CVSS 3.1HIGH 7.8
  • TI-2021-21546 An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in… CVSS 3.1HIGH 7.8
  • TI-2025-21098 An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via… CVSS 3.1MEDIUM 5.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences