CVE-2026-33466

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:logstash::::::::
	cpe:2.3:a:elastic:logstash::::::::
	cpe:2.3:a:elastic:logstash::::::::

History

No history.

Information

Published : 2026-04-08 18:26

Updated : 2026-07-24 23:10

NVD link : CVE-2026-33466

Mitre link : CVE-2026-33466

CVE.ORG link : CVE-2026-33466

JSON object : View

Products Affected

elastic

logstash

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-33466", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33466", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Logstash", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.13"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-08T18:26:00.557", "references": [{"url": "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816", "tags": ["Mitigation", "Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution."}, {"lang": "es", "value": "La Limitaci\u00f3n Inadecuada de un Nombre de Ruta a un Directorio Restringido (CWE-22) en Logstash puede conducir a la escritura arbitraria de archivos y potencialmente a la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de Salto de Ruta Relativo (CAPEC-139). Las utilidades de extracci\u00f3n de archivos utilizadas por Logstash no validan correctamente las rutas de archivo dentro de archivos comprimidos. Un atacante que puede entregar un archivo especialmente dise\u00f1ado a Logstash a trav\u00e9s de un punto final de actualizaci\u00f3n comprometido o controlado por el atacante puede escribir archivos arbitrarios en el sistema de archivos del host con los privilegios del proceso de Logstash. En ciertas configuraciones donde la recarga autom\u00e1tica de pipelines est\u00e1 habilitada, esto puede escalarse a ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2026-07-24T23:10:00.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55DBE8FA-7310-4495-974D-98C32189B038", "versionEndExcluding": "8.19.14", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00CAA64C-2749-427D-B403-5A42B6ABBB1F", "versionEndExcluding": "9.2.8", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55ADA858-5D32-4C8A-865B-BD386A9615B7", "versionEndExcluding": "9.3.3", "versionStartIncluding": "9.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}