Executive brief
Suricata is a network security monitoring and intrusion detection system used to protect enterprise networks. A malicious security rule could exploit a path traversal vulnerability to write files to arbitrary locations on the filesystem when rules are loaded or reloaded, potentially compromising system integrity or enabling further attacks.
Technical details
A path traversal vulnerability (CWE-22) exists in Suricata's rule processing, where the "load" and "save" dataset commands do not properly validate file paths. An attacker with the ability to provide or modify Suricata rules can specify absolute or traversal paths in the "save" parameter to write files anywhere on the filesystem during rule load or reload operations. This requires administrator/rule-creation privileges and manual rule reload. The vulnerability is fixed in versions 7.0.16 and 8.0.5; workarounds include preprocessing rules to strip absolute paths, using privilege dropping to limit writable files, or configuring landlock restrictions.
Affected products
- OISF Suricata before 7.0.16 and 8.0.5
Timeline
- 2026-05-19: disclosed
- 2026-05-19: patched: Fixed in versions 7.0.16 and 8.0.5