The vulnerability is a path traversal flaw in rsyslog's omfile dynaFile facility that allows an attacker to inject arbitrary output paths derived from untrusted input. When a dynaFile template incorporates such input without explicit secure-path handling, the rendered file path can escape the operator's intended directory, enabling an arbitrary file write with the privileges of the rsyslog process. If the process runs as root, this can lead to remote code execution.

Affected systems include the rsyslog software platform from version 1.15.0 through 8.2610.0. These releases support dynamic output paths via the dynaFile facility, and the flaw exists on all operating systems where rsyslog is installed, such as Linux distributions, FreeBSD, and OpenBSD. Any configuration that uses dynaFile templates with untrusted fields is vulnerable.

The CVSS score of 8.1 indicates a high severity condition. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector involves an adversary sending a crafted syslog message that contains a template value derived from untrusted data, such as a HOSTNAME or other field, which rsyslog processes. This can be performed remotely via any protocol that rsyslog accepts log data over, or locally where a compromised user can influence log input.