Executive brief
Elastic Logstash, a data processing engine, is vulnerable to a security flaw in its GeoIP database downloader. An attacker who can control the update server or intercept the update traffic can write malicious files to the server running Logstash. In some cases, this can allow the attacker to take full control of the system by executing arbitrary code.
Technical details
A path traversal vulnerability (CWE-22) exists in Logstash's archive extraction utilities used by the GeoIP database downloader. When Logstash fetches updates from a compromised or attacker-controlled endpoint, it fails to properly validate file paths within the compressed archives. This allows an attacker to perform a Relative Path Traversal (CAPEC-139) to write arbitrary files with the privileges of the Logstash process. If automatic pipeline reloading is enabled and the configuration directory is writable, this can be escalated to remote code execution (RCE). The vulnerability is mitigated by upgrading to patched versions or disabling the GeoIP downloader.
Affected products
- Elastic Logstash 8.0.0 to 8.19.13, 9.0.0 to 9.2.7, 9.3.0 to 9.3.2
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in versions 8.19.14, 9.2.8, and 9.3.3