CVE-2026-33466 — CVE & Security Advisory Radar

🎯 CVE-2026-33466 HIGH 8.1 🔥 EPSS 55% 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2026-33466 | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.

Klassifikation & Betroffenheit:

CWE-22 Elastic Logstash 8.0.0 ≤8.19.13elastic logstash *

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 🎯 High

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

🛡️ Empfohlene Mitigation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all …

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-64 · Using Slashes and URL Encoding Combined … (High) CAPEC-76 · Manipulating Web Input to File System Ca… (Very High) CAPEC-78 · Using Escaped Slashes in Alternate Encod… (High) CAPEC-79 · Using Slashes in Alternate Encoding (High) CAPEC-126 · Path Traversal (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-27699 9.1 CVE-2025-37729 9.1 CVE-2025-25014 9.1 CVE-2024-37285 9.1 CVE-2024-37287 9.1

🩹 Patch verfügbar (OSV):

🩹 cf9cf67b8b3b7e995ff076679609a1bb8aa0efa5 (Commit) 🩹 3e2bf2d3b86563d5ba1e733478b4cca42d9d1612 (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

🔗 discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-u…

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 04/2026

Heute 05.09.

CVSS-Vektor-Analyse: 8.1

AV · Angriffsvektor Netzwerk

AC · Komplexität Hoch

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:08.04.2026

Aktualisiert:24.07.2026 23:10

Assigner (CNA):elastic

EUVD-ID:EUVD-2026-20526

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-05
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

8.1 HIGH

🇪🇺 EUVD

EPSS

55%

CVE-2026-33466 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

Elastic

CVE-2026-33466 | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

08.04.2026

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub