Vulnerability-Lookup

CVE-2026-33466 (GCVE-0-2026-33466)

Vulnerability from cvelistv5 – Published: 2026-04-08 16:50 – Updated: 2026-04-10 03:56

Title

Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write

Summary

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

elastic

References

1 reference

URL	Tags
https://discuss.elastic.co/t/logstash-8-19-14-9-2…

Impacted products

1 product

Vendor	Product	Version
Elastic	Logstash	Affected: 8.0.0 , ≤ 8.19.13 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33466",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-10T03:56:01.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Logstash",
          "vendor": "Elastic",
          "versions": [
            {
              "lessThanOrEqual": "8.19.13",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.\u003c/p\u003e"
            }
          ],
          "value": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-139",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-139 Relative Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:50:42.186Z",
        "orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
        "shortName": "elastic"
      },
      "references": [
        {
          "url": "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816"
        }
      ],
      "source": {
        "discovery": "Elastic"
      },
      "title": "Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write",
      "x_generator": {
        "engine": "Elastic CVE Publisher 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
    "assignerShortName": "elastic",
    "cveId": "CVE-2026-33466",
    "datePublished": "2026-04-08T16:50:42.186Z",
    "dateReserved": "2026-03-20T10:53:23.100Z",
    "dateUpdated": "2026-04-10T03:56:01.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33466",
      "date": "2026-08-01",
      "epss": "0.00545",
      "percentile": "0.42649"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33466\",\"sourceIdentifier\":\"security@elastic.co\",\"published\":\"2026-04-08T18:26:00.557\",\"lastModified\":\"2026-07-24T23:10:00.563\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.\"},{\"lang\":\"es\",\"value\":\"La Limitaci\u00f3n Inadecuada de un Nombre de Ruta a un Directorio Restringido (CWE-22) en Logstash puede conducir a la escritura arbitraria de archivos y potencialmente a la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de Salto de Ruta Relativo (CAPEC-139). Las utilidades de extracci\u00f3n de archivos utilizadas por Logstash no validan correctamente las rutas de archivo dentro de archivos comprimidos. Un atacante que puede entregar un archivo especialmente dise\u00f1ado a Logstash a trav\u00e9s de un punto final de actualizaci\u00f3n comprometido o controlado por el atacante puede escribir archivos arbitrarios en el sistema de archivos del host con los privilegios del proceso de Logstash. En ciertas configuraciones donde la recarga autom\u00e1tica de pipelines est\u00e1 habilitada, esto puede escalarse a ejecuci\u00f3n remota de c\u00f3digo.\"}],\"affected\":[{\"source\":\"security@elastic.co\",\"affectedData\":[{\"vendor\":\"Elastic\",\"product\":\"Logstash\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.0.0\",\"lessThanOrEqual\":\"8.19.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@elastic.co\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-09T00:00:00+00:00\",\"id\":\"CVE-2026-33466\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@elastic.co\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.19.14\",\"matchCriteriaId\":\"55DBE8FA-7310-4495-974D-98C32189B038\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.2.8\",\"matchCriteriaId\":\"00CAA64C-2749-427D-B403-5A42B6ABBB1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.3.0\",\"versionEndExcluding\":\"9.3.3\",\"matchCriteriaId\":\"55ADA858-5D32-4C8A-865B-BD386A9615B7\"}]}]}],\"references\":[{\"url\":\"https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816\",\"source\":\"security@elastic.co\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-04-10T07:22:48+00:00",
      "cve": "CVE-2026-33466",
      "id": "CVE-2026-33466",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33466.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33466\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-08T19:12:46.486593Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-08T19:13:04.010Z\"}}], \"cna\": {\"title\": \"Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write\", \"source\": {\"discovery\": \"Elastic\"}, \"impacts\": [{\"capecId\": \"CAPEC-139\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-139 Relative Path Traversal\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Elastic\", \"product\": \"Logstash\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.19.13\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816\"}], \"x_generator\": {\"engine\": \"Elastic CVE Publisher 0.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eImproper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"271b6943-45a9-4f3a-ab4e-976f3fa05b5a\", \"shortName\": \"elastic\", \"dateUpdated\": \"2026-04-08T16:50:42.186Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33466\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-10T03:56:01.015Z\", \"dateReserved\": \"2026-03-20T10:53:23.100Z\", \"assignerOrgId\": \"271b6943-45a9-4f3a-ab4e-976f3fa05b5a\", \"datePublished\": \"2026-04-08T16:50:42.186Z\", \"assignerShortName\": \"elastic\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-logstash-2026-33466

Vulnerability from bitnami_vulndb

Published

2026-04-13 05:42

Modified

2026-04-22 09:10

Summary

Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "logstash",
        "purl": "pkg:bitnami/logstash"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.19.14"
            },
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.2.8"
            },
            {
              "introduced": "9.3.0"
            },
            {
              "fixed": "9.3.3"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33466"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:elastic:logstash:*:*:*:*:*:ruby:*:*"
    ],
    "severity": "Critical"
  },
  "details": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.",
  "id": "BIT-logstash-2026-33466",
  "modified": "2026-04-22T09:10:06.651Z",
  "published": "2026-04-13T05:42:10.653Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33466"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write"
}

CERTFR-2026-AVI-0413

Vulnerability from certfr_avis - Published: 2026-04-09 - Updated: 2026-04-09

De multiples vulnérabilités ont été découvertes dans les produits Elastic. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Elastic	Logstash	Logstash versions 9.x antérieures à 9.2.8
Elastic	Kibana	Kibana versions 9.3.x antérieures à 9.3.3
Elastic	Kibana	Kibana versions 8.x antérieures à 8.9.14
Elastic	Logstash	Logstash versions 8.x antérieures à 8.9.13
Elastic	Kibana	Kibana versions 9.x antérieures à 9.2.8
Elastic	Logstash	Logstash versions 9.3.x antérieures à 9.3.3

References

Title

Publication Time

FKIE_CVE-2026-33466

Vulnerability from fkie_nvd - Published: 2026-04-08 18:26 - Updated: 2026-06-17 10:37

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@elastic.co	https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816	Mitigation, Vendor Advisory

Impacted products

Vendor	Product	Version
elastic	logstash	*
elastic	logstash	*
elastic	logstash	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Logstash",
          "vendor": "Elastic",
          "versions": [
            {
              "lessThanOrEqual": "8.19.13",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@elastic.co"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "55DBE8FA-7310-4495-974D-98C32189B038",
              "versionEndExcluding": "8.19.14",
              "versionStartIncluding": "8.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "00CAA64C-2749-427D-B403-5A42B6ABBB1F",
              "versionEndExcluding": "9.2.8",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "55ADA858-5D32-4C8A-865B-BD386A9615B7",
              "versionEndExcluding": "9.3.3",
              "versionStartIncluding": "9.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution."
    }
  ],
  "id": "CVE-2026-33466",
  "lastModified": "2026-06-17T10:37:32.727",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "security@elastic.co",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33466",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-09T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-08T18:26:00.557",
  "references": [
    {
      "source": "security@elastic.co",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816"
    }
  ],
  "sourceIdentifier": "security@elastic.co",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security@elastic.co",
      "type": "Secondary"
    }
  ]
}

GHSA-W3RV-2CR7-P2WH

Vulnerability from github – Published: 2026-04-08 18:34 – Updated: 2026-04-08 18:34

Details

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-33466"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-08T18:26:00Z",
    "severity": "HIGH"
  },
  "details": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.",
  "id": "GHSA-w3rv-2cr7-p2wh",
  "modified": "2026-04-08T18:34:08Z",
  "published": "2026-04-08T18:34:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33466"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1025

Vulnerability from csaf_certbund - Published: 2026-04-08 22:00 - Updated: 2026-04-08 22:00

Summary

LogStash: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Logstash ist eine Software zur simultanen Verarbeitung von Datenströmen aus unterschiedlichen Quellen.

Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in LogStash ausnutzen, um beliebige Dateien zu schreiben oder möglicherweise beliebigen Code auszuführen.

Betroffene Betriebssysteme: - Sonstiges - UNIX

CVE-2026-33466

Affected products

Known affected 3 products

Product	Identifier	Version	Remediation
Open Source LogStash <9.2.8 Open Source / LogStash		<9.2.8
Open Source LogStash <9.3.3 Open Source / LogStash		<9.3.3
Open Source LogStash <8.19.14 Open Source / LogStash		<8.19.14

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://discuss.elastic.co/t/logstash-8-19-14-9-2…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Logstash ist eine Software zur simultanen Verarbeitung von Datenstr\u00f6men aus unterschiedlichen Quellen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in LogStash ausnutzen, um beliebige Dateien zu schreiben oder m\u00f6glicherweise beliebigen Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1025 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1025.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1025 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1025"
      },
      {
        "category": "external",
        "summary": "Elastic Security Advisory ESA-2026-29 vom 2026-04-08",
        "url": "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816"
      }
    ],
    "source_lang": "en-US",
    "title": "LogStash: Schwachstelle erm\u00f6glicht Ausf\u00fchren von beliebigem Programmcode mit den Rechten des Dienstes",
    "tracking": {
      "current_release_date": "2026-04-08T22:00:00.000+00:00",
      "generator": {
        "date": "2026-04-09T10:54:05.306+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-1025",
      "initial_release_date": "2026-04-08T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-04-08T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.19.14",
                "product": {
                  "name": "Open Source LogStash \u003c8.19.14",
                  "product_id": "T052574"
                }
              },
              {
                "category": "product_version",
                "name": "8.19.14",
                "product": {
                  "name": "Open Source LogStash 8.19.14",
                  "product_id": "T052574-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:elasticsearch:logstash:8.19.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.2.8",
                "product": {
                  "name": "Open Source LogStash \u003c9.2.8",
                  "product_id": "T052575"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.8",
                "product": {
                  "name": "Open Source LogStash 9.2.8",
                  "product_id": "T052575-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:elasticsearch:logstash:9.2.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.3.3",
                "product": {
                  "name": "Open Source LogStash \u003c9.3.3",
                  "product_id": "T052576"
                }
              },
              {
                "category": "product_version",
                "name": "9.3.3",
                "product": {
                  "name": "Open Source LogStash 9.3.3",
                  "product_id": "T052576-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:elasticsearch:logstash:9.3.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LogStash"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33466",
      "product_status": {
        "known_affected": [
          "T052575",
          "T052576",
          "T052574"
        ]
      },
      "release_date": "2026-04-08T22:00:00.000+00:00",
      "title": "CVE-2026-33466"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-33466 (GCVE-0-2026-33466)

bit-logstash-2026-33466

Vulnerability from bitnami_vulndb

CERTFR-2026-AVI-0413

Solutions

FKIE_CVE-2026-33466

GHSA-W3RV-2CR7-P2WH

WID-SEC-W-2026-1025

Tags

Sightings

Nomenclature