Read the docs
TI-2026-79284 Aliases CVE-2026-92709

Path traversal in rsyslog dynaFile lets attackers write files

Priority LOW 37CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Rsyslog versions from 1.15.0 through 8.2610.0 are affected. The omfile dynaFile facility can write outside the intended log directory when a template uses an untrusted value as a path component (CWE-22). A remote attacker with no privileges and no user interaction can write arbitrary files, which can lead to code execution as root.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00375 31st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rsyslogrsyslog1.15.0 – 8.2610.0—No fix listedCNA
  • rsyslog Vendorrsyslog Affected 1.15.0 – 8.2610.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for rsyslog. Red Hat lists no available plan for Red Hat Enterprise Linux 6, 7, 8, 9 and 10. Until a fix is available, avoid using untrusted values as dynaFile path components without explicit secure-path handling.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-92709
  2. 2026-10-23 Affected versions changed · Red Hat
  3. 2026-10-23 CVSS score added · Red Hat
  4. 2026-10-23 Priority changed: MEDIUM → LOW
  5. 2026-10-29 CISA SSVC decision points changed

References

Other 1

  • TI-2026-40100 Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling CVSS 4.0HIGH 8.2
  • TI-2018-15792 rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in… CVSS 3.0CRITICAL 9.8
  • TI-2019-12711 An issue was discovered in Rsyslog v8.1908.0. CVSS 3.1CRITICAL 9.8
  • TI-2019-12712 An issue was discovered in Rsyslog v8.1908.0. CVSS 3.1CRITICAL 9.8
  • TI-2019-12710 contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled. CVSS 3.1CRITICAL 9.8
  • TI-2017-09315 The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields… CVSS 3.0CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences