CVE-2026-33466: Logstash Path Traversal RCE Vulnerability

CVE-2026-33466 Overview

CVE-2026-33466 is a path traversal vulnerability in Logstash that allows an attacker to write arbitrary files to the host filesystem. The flaw exists in the archive extraction utilities used by Logstash, which fail to properly validate file paths within compressed archives. When Logstash processes a specially crafted archive from a compromised or attacker-controlled update endpoint, an attacker can escape the intended directory and write files anywhere on the filesystem with the privileges of the Logstash process.

Critical Impact

This vulnerability can lead to arbitrary file write on affected systems, and in configurations where automatic pipeline reloading is enabled, the file write capability can be escalated to achieve remote code execution.

Affected Products

• Logstash versions prior to 8.19.14
• Logstash versions 9.2.x prior to 9.2.8
• Logstash versions 9.3.x prior to 9.3.3

Discovery Timeline

• April 8, 2026 - CVE-2026-33466 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33466

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The underlying issue stems from inadequate input validation in the archive extraction routines used by Logstash.

When Logstash extracts files from compressed archives, such as those obtained during plugin installations or updates, it processes file paths embedded within the archive structure. An attacker can craft a malicious archive containing entries with relative path components (such as ../) that, when extracted, resolve to locations outside the intended destination directory. This attack pattern is described as CAPEC-139 (Relative Path Traversal).

The attack requires that an adversary be able to serve a crafted archive to the Logstash instance. This could be achieved by compromising an update endpoint, performing a man-in-the-middle attack, or by gaining control of a repository that Logstash trusts for plugin installations.

Root Cause

The root cause of CVE-2026-33466 lies in insufficient path sanitization during archive extraction. When decompressing archives, the extraction logic fails to:

1. Canonicalize extracted file paths to remove relative path components
2. Verify that the resulting destination path remains within the intended extraction directory
3. Reject archive entries containing malicious path sequences such as ../ or absolute paths

This allows attackers to escape the extraction directory boundary and place files in arbitrary filesystem locations.

Attack Vector

The attack vector is network-based, requiring the attacker to deliver a malicious archive to the target Logstash instance. The attack flow typically involves:

1. Initial Setup: The attacker creates a specially crafted compressed archive containing files with path traversal sequences in their names (e.g., ../../etc/cron.d/malicious-job)

2. Delivery: The malicious archive is served to Logstash through a compromised update endpoint, DNS hijacking, or man-in-the-middle attack against plugin installation traffic

3. Extraction: When Logstash processes the archive, it extracts files without properly validating paths, allowing files to be written outside the intended directory

4. Escalation to RCE: In environments where automatic pipeline reloading is enabled, the attacker can write a malicious pipeline configuration file to Logstash's pipeline directory. When the configuration is automatically reloaded, malicious filter plugins or Ruby code embedded in the configuration can execute arbitrary commands

The vulnerability mechanism exploits the lack of path validation in archive extraction. For technical implementation details, refer to the Elastic Security Update Discussion.

Detection Methods for CVE-2026-33466

Indicators of Compromise

• Unexpected files appearing outside Logstash's installation or data directories, particularly in sensitive system locations such as /etc/cron.d/, /etc/logstash/pipeline/, or user home directories
• Modified or newly created pipeline configuration files that were not authorized by administrators
• Unusual network connections from Logstash to untrusted external endpoints during plugin installation or updates
• Log entries showing archive extraction operations with suspicious file paths containing ../ sequences

Detection Strategies

• Monitor file integrity of Logstash configuration directories (/etc/logstash/ and pipeline directories) using FIM (File Integrity Monitoring) tools
• Implement network monitoring to detect connections from Logstash to unauthorized update endpoints or unexpected external hosts
• Review Logstash logs for unusual plugin installation activity or errors related to file extraction
• Deploy endpoint detection rules to identify processes writing files with path traversal patterns

Monitoring Recommendations

• Enable detailed logging in Logstash to capture plugin installation and update activities
• Configure alerts for any file modifications in system directories by the Logstash process user account
• Monitor for unauthorized changes to automatic pipeline reload configurations
• Implement network segmentation to restrict Logstash's ability to reach external update sources

How to Mitigate CVE-2026-33466

Immediate Actions Required

• Upgrade Logstash to patched versions: 8.19.14, 9.2.8, or 9.3.3 depending on your version branch
• If immediate patching is not possible, disable automatic pipeline reloading to prevent the escalation to remote code execution
• Restrict network access from Logstash instances to only trusted, verified update endpoints
• Review recently installed plugins and verify their integrity against official checksums

Patch Information

Elastic has released security patches addressing this vulnerability in Logstash versions 8.19.14, 9.2.8, and 9.3.3. Full details are available in the Elastic Security Advisory ESA-2026-29. Organizations should prioritize upgrading to these versions to address the path traversal flaw in archive extraction.

Workarounds

• Disable automatic pipeline reloading by setting config.reload.automatic: false in logstash.yml to prevent escalation from file write to code execution
• Implement strict network controls to ensure Logstash can only download plugins from official Elastic repositories
• Run Logstash with minimal filesystem privileges to limit the impact of arbitrary file writes
• Use read-only filesystem mounts where possible to restrict write access to sensitive directories

# Disable automatic pipeline reloading in logstash.yml
echo "config.reload.automatic: false" >> /etc/logstash/logstash.yml

# Restrict plugin installation to offline mode (pre-downloaded plugins only)
bin/logstash-plugin install --local /path/to/verified-plugins/

# Verify Logstash is running with limited privileges
ps aux | grep logstash