Executive brief
Vector is a data processing pipeline that writes observability data to files using templated paths. In versions before 0.57.0, when untrusted event data is used in file path templates, an attacker can inject absolute paths or traversal sequences to create or overwrite files outside the intended directory, potentially modifying system files or scripts with Vector's privileges and leading to code execution.
Technical details
The file sink in Vector renders templated output paths using event fields without proper path confinement. An untrusted event source can supply field values containing absolute paths or parent-directory traversal sequences (e.g., ../../../), allowing file writes outside the configured output directory. The vulnerability requires the attacker to control event field values supplied to the path template, and impacts the confidentiality and integrity of files with Vector's process privileges.
Affected products
- Vector Vector 0.10.0 to 0.56.x
Timeline
- 2026-09-22: disclosed
- 2026-07-13: patched: Fixed in version 0.57.0