Read the docs
TI-2026-25862 Aliases CVE-2026-33466GHSA-w3rv-2cr7-p2wh

Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00554 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticLogstash8.0.0 – 8.19.13—No fix listedCNA
  • Logstash VendorElastic Affected 8.0.0 – 8.19.13 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*8.0.0 to before 8.19.14; 9.0.0 to before 9.2.8; 9.3.0 to before 9.3.3VulnerableElastic
  • cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.19.14; 9.0.0 to before 9.2.8; 9.3.0 to before 9.3.3 Vulnerable ·Elastic

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33466
  2. 2026-10-03 Alias added: GHSA-w3rv-2cr7-p2wh
  3. 2026-10-21 EPSS moved to the below the 50th percentile

References

Advisory 1

  • TI-2019-05366 Information disclosure through error messages in Elastic Logstash CVSS 3.1CRITICAL 9.8
  • TI-2014-03539 Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2015-04531 Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read… CVSS 3.0HIGH 7.5
  • TI-2019-05374 Uncontrolled resource consumption in Elastic Logstash CVSS 3.1HIGH 7.5
  • TI-2023-25173 Logstash Insertion of Sensitive Information into Log File CVSS 3.1HIGH 8.4
  • TI-2016-09350 Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP… CVSS 3.0HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences