CVE-2025-12972

Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/
https://www.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover

Configurations

Configuration 1 (hide)

cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) El plugin out_file de Fluent Bit no sanitiza correctamente los valores de las etiquetas al derivar los nombres de los archivos de salida. Cuando se omite la opción File, el plugin utiliza entradas de etiquetas no confiables para construir rutas de archivo. Esto permite a los atacantes con acceso a la red crear etiquetas que contengan secuencias de salto de ruta que hacen que Fluent Bit escriba archivos fuera del directorio de salida previsto.

Information

Published : 2025-11-24 15:15

Updated : 2026-10-08 10:10

NVD link : CVE-2025-12972

Mitre link : CVE-2025-12972

CVE.ORG link : CVE-2025-12972

JSON object : View

Products Affected

treasuredata

fluent_bit

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-12972", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12972", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T19:09:06.151697Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "FluentBit", "product": "Fluent Bit", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.12", "versionType": "custom"}]}]}], "published": "2025-11-24T15:15:46.627", "references": [{"url": "https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/", "source": "cret@cert.org"}, {"url": "https://www.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover", "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory."}, {"lang": "es", "value": "El plugin out_file de Fluent Bit no sanitiza correctamente los valores de las etiquetas al derivar los nombres de los archivos de salida. Cuando se omite la opci\u00f3n File, el plugin utiliza entradas de etiquetas no confiables para construir rutas de archivo. Esto permite a los atacantes con acceso a la red crear etiquetas que contengan secuencias de salto de ruta que hacen que Fluent Bit escriba archivos fuera del directorio de salida previsto."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D0EA105-B741-4E44-828A-9300B09A7A79"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}