CVE-2026-44024_exploit

CVE-2026-44024——Fluentd outfile $tag 路径遍历导致的任意文件写入 未认证的任意文件写入存在于 Fluentd 的 outfile 插件中，通过 $tag 占位符触发。 outfile 允许运维人员使用 $tag 占位符来模板化输出路径（例如 path /var/log/fluent/$tag）。Outputextractplaceholders（lib/fluent/plugin/output.rb）会将事件的标签替换到路径中，且不清理../（CWE-22）： if str.include?'$tag' rvalue =...

CVE-2026-44024

A flaw was found in Fluentd, a data collector. This vulnerability allows a remote attacker to achieve arbitrary file write and potentially remote code execution by sending untrusted tags containing path traversal characters. The issue arises from insufficient validation of the $tag placeholder in...

CVE-2026-44024 Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the $tag placeholder, and insufficient validation of $tag in file configurations such as the path...

CVE-2026-44024

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the $tag placeholder, and insufficient validation of $tag in file configurations such as the path...

CVE-2026-44024

CVE-2026-44024 affects Fluentd. The issue arises when file paths are dynamically constructed via the ${tag} placeholder in configurations (notably in the out_file plugin). Insufficient validation of ${tag} with untrusted tags can introduce path traversal, enabling an attacker to write or overwrit...

CVE-2026-44024: Improper Limitation of a Pathname to a Restricted Directory

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the $tag placeholder, and insufficient validation of $tag in file configurations such as the path...

ROS-20260319-73-0009

A vulnerability in the outfile plugin of the Fluent Bit logging tool is related to an incorrect directory path name restriction. Exploitation of the vulnerability could allow an attacker acting remotely to write an arbitrary file outside the target directory...

The vulnerability of the out_file plugin of the Fluent Bit log collection and processing tool allows a malicious actor to write any file outside of the target directory.

The vulnerability of the outfile plugin of the Fluent Bit logging and processing tool is related to an incorrect restriction on the path name for the directory. Exploiting this vulnerability could allow a malicious actor to write any file outside of the target directory...

BIT-FLUENT-BIT-2025-12972 CVE-2025-12972

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

EUVD-2025-198810

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

CVE-2025-12972

The Fluent Bit logging tool's out_file plugin is vulnerable to a path traversal vulnerability (CVE-2025-12972 ) because it fails to properly sanitize tag values when deriving output filenames. If the File option is omitted, the plugin uses untrusted tag input to construct file paths, allowing an ...

CVE-2025-12972 CVE-2025-12972

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

CVE-2025-12972: Improper Limitation of a Pathname to a Restricted Directory

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...