Elastic Logstash version 8.0.0 contains a CWE-22 Improper Limitation of a Pathname to a Restricted Directory vulnerability. The issue arises because the archive extraction utilities do not validate file paths inside compressed archives, enabling relative path traversal (CAPEC-139). An attacker able to deliver a malicious archive through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. If automatic pipeline reloading is enabled, this can escalate to remote code execution. The vulnerability is publicly known and assigned CVE-2026-33466 with a CVSS 3.1 score of 8.1 (high severity). No patch or official remediation has been published yet.

Successful exploitation allows arbitrary file write on the host system with Logstash process privileges, potentially leading to remote code execution in configurations with automatic pipeline reloading enabled. This can compromise the integrity and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to update endpoints and disable automatic pipeline reloading if feasible to reduce risk. Monitor for updates from Elastic regarding patches or mitigations.