CVE-2026-92709: rsyslog omfile dynaFile path traversal

CVE-2026-92709 · Severity: high · CVSS 8.1 · Published 2026-10-22

rsyslog is a system log processing daemon that routes and stores log messages. When configured with dynaFile templates that incorporate untrusted input (such as remote hostnames) without explicit path-hardening, an attacker can write logs to arbitrary filesystem locations outside the intended log directory. This could enable attackers to overwrite system files or gain code execution if rsyslog runs with elevated privileges.

Technologies: Rsyslog. Vendors: Rsyslog.

Quick answers

Is CVE-2026-92709 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92709 being exploited in the wild.
How severe is CVE-2026-92709?
High severity, with a CVSS score of 8.1, published 22 October 2026.
Which products and versions are affected?
Rsyslog 1.15.0 through 8.2610.0.
Is there a fix for CVE-2026-92709?
No fixed version is recorded yet. Apply explicit secure-path handling (securepath, secpath-drop, or secpath-replace) to all untrusted values in dynaFile templates. Alternatively, enable strict security defaults with global(compatibility.defaults.secure="strict"), or use warn mode to identify and remediate affected templates. Run rsyslog with the least privileges necessary and apply OS-level confinement. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92709 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-92709?
Check whether you run Rsyslog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Apply explicit secure-path handling (securepath, secpath-drop, or secpath-replace) to all untrusted values in dynaFile templates. Alternatively, enable strict security defaults with global(compatibility.defaults.secure="strict"), or use warn mode to identify and remediate affected templates. Run rsyslog with the least privileges necessary and apply OS-level confinement.

Technical details

The omfile output module's dynaFile facility allows templates to generate dynamic output paths. A path-traversal vulnerability occurs when untrusted values (not limited to RFC5424 HOSTNAME) reach dynaFile path components without securepath, secpath-drop, or secpath-replace filtering. An attacker who can influence such input via network streams or other rsyslog input sources can craft paths containing ".." sequences to escape the intended log directory and write files as the rsyslog process user.

Affected products

  • rsyslog rsyslog 1.15.0 through 8.2610.0

Timeline

  • 2026-10-22: disclosed
  • 2026-08-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.