Assessment
Why it matters
EPSS is 0.5%; technical severity is CVSS 9.8.
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.
Who should care
- Teams operating Logstash
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Logstash is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Vendor advisory from discuss.elastic.co
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-22
- Affected versions
- Elastic Logstash (Start Including 8.0.0, End Excluding 8.19.14 | Start Including 9.0.0, End Excluding 9.2.8 | Start Including 9.3.0, End Excluding 9.3.3)
- Fixed versions
- Elastic Logstash (Fixed from 8.19.14, 9.2.8, 9.3.3)
- Published
- 8 April 2026
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Latest EPSS score: 0.5%
- Signal calculated at 14