Improper limitation of pathname within Logstash when extracting compressed archives allows an attacker to craft a specially formed archive that writes files outside the intended directory. This lack of validation results in arbitrary file write and, in configurations with automatic pipeline reloading, can be escalated to execution of malicious code on the host. The weakness maps to CWE‑22, relative path traversal (CAPEC‑139).

Elastic Logstash is affected. No specific product version information is supplied in the advisory, so all deployed Logstash instances should be inspected for recent update controls. The vulnerability exists wherever the archive extraction utilities are used without proper path validation.

The CVSS score of 8.1 indicates high severity. EPSS data is not available, and the flaw is not yet listed in CISA’s KEV catalog, implying it may not yet be widely exploited. However, the attack requires an attacker to supply a crafted archive through a compromised or attacker‑controlled update endpoint, a mistake that is relatively easy to satisfy if the update channel is not tightly secured. Once the malicious archive is ingested, Logstash writes files with its own ownership, giving the attacker full access to the host filesystem where an automated pipeline reload could trigger arbitrary code execution. This combination of high severity, straightforward exploitation path, and potential for system‑wide compromise results in a high overall risk.