CVE-2026-33466: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Elastic Logstash
CVE-2026-33466 is a path traversal vulnerability in Elastic Logstash version 8. 0. 0. The issue arises because the archive extraction utilities do not properly validate file paths within compressed archives. An attacker able to supply a specially crafted archive via a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with Logstash process privileges. If automatic pipeline reloading is enabled, this arbitrary file write can escalate to remote code execution. The vulnerability has a high severity score of 8. 1 and affects confidentiality, integrity, and availability of the affected system.
AI Analysis
Technical Summary
Elastic Logstash 8.0.0 contains a CWE-22 Improper Limitation of a Pathname to a Restricted Directory vulnerability. The archive extraction component fails to validate relative paths in compressed archives, enabling an attacker who controls the update source to perform relative path traversal. This allows arbitrary file writes on the host system with Logstash process privileges. In configurations with automatic pipeline reloading enabled, this can lead to remote code execution. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.
Potential Impact
Successful exploitation allows an attacker to write arbitrary files on the host filesystem with the privileges of the Logstash process. This can lead to remote code execution in environments where automatic pipeline reloading is enabled, posing a significant risk to system confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to update endpoints and disable automatic pipeline reloading if enabled to reduce risk. Monitor vendor communications for patches or official mitigations.
CVE-2026-33466: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Elastic Logstash
Description
CVE-2026-33466 is a path traversal vulnerability in Elastic Logstash version 8. 0. 0. The issue arises because the archive extraction utilities do not properly validate file paths within compressed archives. An attacker able to supply a specially crafted archive via a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with Logstash process privileges. If automatic pipeline reloading is enabled, this arbitrary file write can escalate to remote code execution. The vulnerability has a high severity score of 8. 1 and affects confidentiality, integrity, and availability of the affected system.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Elastic Logstash 8.0.0 contains a CWE-22 Improper Limitation of a Pathname to a Restricted Directory vulnerability. The archive extraction component fails to validate relative paths in compressed archives, enabling an attacker who controls the update source to perform relative path traversal. This allows arbitrary file writes on the host system with Logstash process privileges. In configurations with automatic pipeline reloading enabled, this can lead to remote code execution. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.
Potential Impact
Successful exploitation allows an attacker to write arbitrary files on the host filesystem with the privileges of the Logstash process. This can lead to remote code execution in environments where automatic pipeline reloading is enabled, posing a significant risk to system confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to update endpoints and disable automatic pipeline reloading if enabled to reduce risk. Monitor vendor communications for patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- elastic
- Date Reserved
- 2026-03-20T10:53:23.100Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d6b19c1cc7ad14daa7cc75
Added to database: 4/8/2026, 7:50:52 PM
Last enriched: 4/16/2026, 12:10:04 PM
Last updated: 5/23/2026, 9:31:34 PM
Views: 263
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.