CVE-2026-44024 Details
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.
A critical vulnerability in Fluentd versions prior to 1.19.3 allows for remote code execution by exploiting the ${tag} placeholder in file path configurations. The issue arises from inadequate validation of tags, enabling attackers to inject path traversal characters and manipulate file paths. This could lead to overwriting arbitrary files or executing malicious code, depending on the overwritten file's nature and the Fluentd process's privileges.
Users are advised to upgrade to Fluentd version 1.19.3. If an immediate upgrade is not possible, restrict network access to Fluentd input ports, run Fluentd as a non-root user, and avoid using the ${tag} placeholder in output file path configurations. Additionally, validate and filter incoming tags to remove any that contain path traversal characters.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437 | [email protected] | Patch |
| https://github.com/fluent/fluentd/pull/5391 | [email protected] | Issue TrackingPatch |
| https://github.com/fluent/fluentd/releases/tag/v1.19.3 | [email protected] | ProductRelease Notes |
| https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fluentd fluentd | < 1.19.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |