Technical impact
Fluentd aggregates event data from a broad range of data sources and routes them to outputs such as files, relational databases, NoSQL stores, cloud services, and Hadoop clusters. In versions before 1.19.3, the out_file plugin and other file‑based output configurations build file paths by interpolating the ${tag} placeholder without adequate validation. An attacker can send a tag that includes path‑traversal characters; this causes Fluentd to write or overwrite arbitrary files on the host, potentially enabling remote code execution if the attacker can place a malicious executable in a location that the system executes. The flaw, classified as CWE‑22, is remedied by upgrading to version 1.19.3.
Affected Systems
The vulnerability affects every Fluentd release from the fluent organization earlier than 1.19.3. Any installation that uses the out_file plugin or any other output that builds file paths from tags is at risk. Sub‑product names are not differentiated, so all Fluentd distributions and forks remain impacted on the vulnerable versions.
Risk and Exploitability
The CVSS score of 9.8 classifies the issue as critical, while the EPSS score of 1 % suggests that exploitation is currently rare but not impossible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit the flaw over the network by injecting malicious tags through any data source that the Fluentd instance subscribes to. If successful, the attacker can overwrite arbitrary files and potentially run arbitrary code, giving full control of the host.
Github GHSA