Unzureichende Beschränkung eines Pfadnamens auf ein eingeschränktes Verzeichnis in Logstash, was zu beliebigem Dateischreiben führt

The primary impact of CVE-2026-33466 is the potential for arbitrary file write. An attacker can craft a malicious archive and, if Logstash is configured to automatically reload pipelines from a compromised source, trigger the extraction process. This allows the attacker to write files to any location accessible by the Logstash process, potentially overwriting critical system files or configuration data. In scenarios where the Logstash process runs with elevated privileges, this could lead to remote code execution, granting the attacker complete control over the affected system. The vulnerability's reliance on a controlled update endpoint or automatic pipeline reloading makes it particularly concerning in environments with automated deployments or external data ingestion.

Organizations heavily reliant on Logstash for centralized logging and data processing are at significant risk. Specifically, environments with automatic pipeline reloading enabled, or those lacking robust input validation on update endpoints, are particularly vulnerable. Shared hosting environments where multiple users share a Logstash instance also face increased risk.

• linux / server:

journalctl -u logstash | grep -i "archive extraction"

• linux / server:

ps aux | grep -i logstash | grep -i "extracting archive"

• generic web:

curl -I <logstash_update_endpoint> | grep -i "Content-Type: application/zip"

1. 2026-04-08Disclosure

   disclosure

1. Reserviert2026-03-20
2. Veröffentlicht2026-04-08
3. Geändert2026-04-10
4. EPSS aktualisiert2026-04-16

The primary mitigation for CVE-2026-33466 is to upgrade Logstash to version 8.19.14 or later. If immediate upgrading is not possible, consider disabling automatic pipeline reloading to prevent attackers from triggering the vulnerability through a compromised update endpoint. Implement strict input validation and sanitization on any data sources used by Logstash. Consider using a Web Application Firewall (WAF) or proxy to inspect incoming archive files for suspicious patterns or path traversal attempts. Monitor Logstash logs for unusual file write activity, particularly in unexpected locations.