Executive brief
Fluentd is a popular data collection tool used to gather logs and events from various sources and route them to storage or analysis platforms. A critical vulnerability allows attackers to manipulate how Fluentd names the files it creates, potentially allowing them to write or overwrite any file on the server. This could lead to a complete system takeover, data loss, or service disruption, especially if Fluentd is configured to receive data from untrusted networks.
Technical details
A path traversal vulnerability (CWE-22) exists in Fluentd's 'extract_placeholders' method. When the '${tag}' placeholder is used in output plugin configurations (such as 'out_file'), Fluentd fails to sufficiently validate the tag string for directory traversal sequences like '../' or absolute paths. An unauthenticated remote attacker can send specially crafted events with malicious tags to write or overwrite arbitrary files on the filesystem. Depending on the environment and process privileges, this can be escalated to remote code execution by overwriting executable files or configuration scripts. The fix, introduced in version 1.19.3, implements strict path boundary validation for the tag variable.
Affected products
- Fluent Fluentd < 1.19.3
Timeline
- 2026-06-25: patched: Fix merged and version 1.19.3 released.
- 2026-06-26: advisory: GitHub Security Advisory GHSA-44hj-4m45-frj3 published.
- 2026-07-08: disclosed: CVE-2026-44024 published to NVD.