CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-33466

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.

Score
8.1 high
Published
2026-04-08
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
sysutils/logstash91logstash919.1.10_3unaddressedelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>logstash91</name>
	<range><lt>8.19.14</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Improper Limitation of a Pathname to a Restricted Directory (CWE-22)
	in Logstash can lead to arbitrary file write and potentially remote
	code execution via Relative Path Traversal (CAPEC-139). The archive
	extraction utilities used by Logstash do not properly validate file
	paths within compressed archives. An attacker who can serve a
	specially crafted archive to Logstash through a compromised or
	attacker-controlled update endpoint can write arbitrary files to the
	host filesystem with the privileges of the Logstash process. In
	certain configurations where automatic pipeline reloading is enabled,
	this can be escalated to remote code execution.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-33466</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-33466</url>
    </references>
    <dates>
      <discovery>2026-04-08</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>