Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbit

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• elastic logstashup to 1.4.2 inclusive

Other highest-scoring records for the same primary product.

• CVE-2019-7612A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs.
  40Plan
• CVE-2026-33466Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write
  39Monitor
• CVE-2019-7620Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin.
  31Monitor
• CVE-2015-5378Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logst
  31Monitor
• CVE-2016-1000221Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive info
  31Monitor
• CVE-2014-4326Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) za
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.