Vector versions from 0.10.0 up to but not including 0.57.0 contain a path traversal vulnerability in the file sink feature. The file sink renders file paths using event fields without restricting the path to a safe directory. If an attacker supplies crafted event field values containing absolute paths or parent-directory traversal sequences, Vector may create or overwrite files outside the intended directory with the privileges of the Vector process. This can lead to modification of sensitive files and potentially code execution if targeted files are scripts or authorization files. The vulnerability is addressed in version 0.57.0.

An attacker able to supply event fields used in the file sink path template can cause Vector to write files arbitrarily on the filesystem with Vector's process privileges. This may allow overwriting sensitive files, leading to privilege escalation or remote code execution if the attacker targets scheduled tasks, authorization files, or executable scripts.

Upgrade Vector to version 0.57.0 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in 0.57.0.