The vulnerability is a path‑traversal flaw in the trace consumer of RabbitMQ. When an administrator submits a trace name through the /api/traces/:vhost/:name endpoint, the server concatenates the supplied name with a .log suffix and writes the file under the trace directory without validating the path. This omission means an attacker with the administrator tag can create or overwrite arbitrary .log files at any location writable by the rabbitmq OS user, such as /etc/cron.d or other critical directories. Successful exploitation could lead to privilege escalation, configuration tampering or denial‑of‑service by corrupting logs or executables.

Affected versions are all releases before 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.1 of RabbitMQ Server. Systems running RabbitMQ Server 3.x or 4.x earlier than these patch levels are vulnerable. The vulnerability is specific to the rabbitmq_tracing plugin when enabled.

The CVSS score is 2.1, indicating low severity, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalogue. Exploitability requires that the target has the administrator tag and that the rabbitmq OS user has write permission to the destination directory; therefore the attack vector is local privileged. While the CVSS hints at low risk, the ability to write arbitrary files may be catastrophic in a misconfigured environment, especially if rabbitmq runs as root or has elevated privileges.