CVE-2026-44024

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437	Patch
https://github.com/fluent/fluentd/pull/5391	Issue Tracking Patch
https://github.com/fluent/fluentd/releases/tag/v1.19.3	Product Release Notes
https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop, etc. Antes de la versión 1.19.3, Fluentd permite la construcción dinámica de rutas de archivo utilizando el marcador de posición ${tag}, y la validación insuficiente de ${tag} en configuraciones de archivo, como el parámetro path del plugin out_file, permite a los atacantes que envían etiquetas no confiables que contienen caracteres de salto de ruta escribir o sobrescribir archivos arbitrarios y potencialmente lograr la ejecución remota de código. Este problema está solucionado en la versión 1.19.3.

Information

Published : 2026-07-08 22:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-44024

Mitre link : CVE-2026-44024

CVE.ORG link : CVE-2026-44024

JSON object : View

Products Affected

fluentd

fluentd

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-44024", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44024", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fluent", "product": "fluentd", "versions": [{"status": "affected", "version": "< 1.19.3"}]}]}], "published": "2026-07-08T22:17:14.337", "references": [{"url": "https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/pull/5391", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3."}, {"lang": "es", "value": "Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop, etc. Antes de la versi\u00f3n 1.19.3, Fluentd permite la construcci\u00f3n din\u00e1mica de rutas de archivo utilizando el marcador de posici\u00f3n ${tag}, y la validaci\u00f3n insuficiente de ${tag} en configuraciones de archivo, como el par\u00e1metro path del plugin out_file, permite a los atacantes que env\u00edan etiquetas no confiables que contienen caracteres de salto de ruta escribir o sobrescribir archivos arbitrarios y potencialmente lograr la ejecuci\u00f3n remota de c\u00f3digo. Este problema est\u00e1 solucionado en la versi\u00f3n 1.19.3."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AB3C52C-7D3D-4BA5-A8D0-8AC7DA6030EC", "versionEndExcluding": "1.19.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}