Fluentd aggregates event data from a variety of sources and writes them to files, databases, cloud services, and Hadoop. In versions earlier than 1.19.3, the out_file plugin and other file-emitters construct a destination path by interpolating the supplied ${tag} placeholder. Because the plugin does not validate or sanitize the tag value, an attacker can supply a tag containing path‑traversal sequences, causing Fluentd to create or overwrite any file on the host. If an attacker writes a malicious executable into a directory that is executed by the system, remote code execution is possible. The vulnerability is identified as CWE‑22 (Path Traversal) and is fixed in Fluentd 1.19.3.

The vulnerability affects every Fluentd release from the fluent organization earlier than 1.19.3. Any installation that uses the out_file plugin or any other output that builds file paths from tags is at risk. Sub‑product names are not differentiated, so all Fluentd distributions and forks remain impacted on the vulnerable versions.

The CVSS score of 9.8 classifies the issue as critical, while the EPSS score of 1 % suggests that exploitation is currently rare but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw over the network by injecting malicious tags through any data source that the Fluentd instance subscribes to. If successful, the attacker can overwrite arbitrary files and potentially run arbitrary code, giving full control of the host.