# CVE-2026-33466: Elastic Logstash path traversal in GeoIP downloader

Source: https://junglewise.ai/threats/cve-2026-33466-elastic-logstash-path-traversal-in-geoip-downloader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33466 · Severity: high · CVSS 8.1 · Published 2026-04-08

Elastic Logstash, a data processing engine, is vulnerable to a security flaw in its GeoIP database downloader. An attacker who can control the update server or intercept the update traffic can write malicious files to the server running Logstash. In some cases, this can allow the attacker to take full control of the system by executing arbitrary code.

Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-33466 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33466 being exploited in the wild.

**How severe is CVE-2026-33466?** High severity, with a CVSS score of 8.1, published 8 April 2026.

**Which products and versions are affected?** Elastic Logstash 8.0.0 to 8.19.13, 9.0.0 to 9.2.7, 9.3.0 to 9.3.2.

**Is there a fix for CVE-2026-33466?** A patch was published on 2026-04-08: Fixed in versions 8.19.14, 9.2.8, and 9.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33466 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33466?** Check whether you run Elastic Logstash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in Logstash's archive extraction utilities used by the GeoIP database downloader. When Logstash fetches updates from a compromised or attacker-controlled endpoint, it fails to properly validate file paths within the compressed archives. This allows an attacker to perform a Relative Path Traversal (CAPEC-139) to write arbitrary files with the privileges of the Logstash process. If automatic pipeline reloading is enabled and the configuration directory is writable, this can be escalated to remote code execution (RCE). The vulnerability is mitigated by upgrading to patched versions or disabling the GeoIP downloader.

## Affected products

- Elastic Logstash 8.0.0 to 8.19.13, 9.0.0 to 9.2.7, 9.3.0 to 9.3.2

## Timeline

- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in versions 8.19.14, 9.2.8, and 9.3.3

## References

- [https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816](https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816)

## Related threats

- [Elastic Docker images certificate validation flaw in OS bundle](https://junglewise.ai/threats/cve-2026-115714-improper-certificate-validation-cwe-295-in-the-operating-system)