CVE-2026-44024
Communications: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2026-44024)
criticalEPSS 1.1%
Affected
- rubygems/fluentd
0.10.57..* - rubygems/fluentd
0.10.58..* - rubygems/fluentd
0.10.59..* - rubygems/fluentd
0.10.6..* - rubygems/fluentd
0.10.60..* - rubygems/fluentd
0.10.61..* - rubygems/fluentd
0.10.62..* - rubygems/fluentd
0.10.7..* - rubygems/fluentd
0.10.8..* - rubygems/fluentd
0.10.9..* - rubygems/fluentd
0.12.0..* - rubygems/fluentd
0.12.0.pre.1..* - rubygems/fluentd
0.12.0.pre.2..* - rubygems/fluentd
0.12.0.pre.3..* - rubygems/fluentd
0.12.1..* - rubygems/fluentd
0.12.10..* - rubygems/fluentd
0.12.11..* - rubygems/fluentd
0.12.12..* - rubygems/fluentd
0.12.13..* - rubygems/fluentd
0.12.14..* - rubygems/fluentd
0.12.15..* - rubygems/fluentd
0.12.16..* - rubygems/fluentd
0.12.17..* - rubygems/fluentd
0.12.18..* - rubygems/fluentd
0.12.19..* - rubygems/fluentd
0.12.2..* - rubygems/fluentd
0.12.20..* - rubygems/fluentd
0.12.21..* - rubygems/fluentd
0.12.22..* - rubygems/fluentd
0.12.23..* - rubygems/fluentd
0.12.24..* - rubygems/fluentd
0.12.25..* - rubygems/fluentd
0.12.26..* - rubygems/fluentd
0.12.27..* - rubygems/fluentd
0.12.28..* - rubygems/fluentd
0.12.29..* - rubygems/fluentd
0.12.3..* - rubygems/fluentd
0.12.30..* - rubygems/fluentd
0.12.31..* - rubygems/fluentd
0.12.32..* - rubygems/fluentd
0.12.33..* - rubygems/fluentd
0.12.34..* - rubygems/fluentd
0.12.35..* - rubygems/fluentd
0.12.36..* - rubygems/fluentd
0.12.37..* - rubygems/fluentd
0.12.38..* - rubygems/fluentd
0.12.39..* - rubygems/fluentd
0.12.4..* - rubygems/fluentd
0.12.40..* - rubygems/fluentd
0.12.41..* - rubygems/fluentd
0.12.42..* - rubygems/fluentd
0.12.43..* - rubygems/fluentd
0.12.5..* - rubygems/fluentd
0.12.6..* - rubygems/fluentd
0.12.7..* - rubygems/fluentd
0.12.8..* - rubygems/fluentd
0.12.9..* - rubygems/fluentd
0.14.0..* - rubygems/fluentd
0.14.1..* - rubygems/fluentd
0.14.10..* - rubygems/fluentd
0.14.11..* - rubygems/fluentd
0.14.12..* - rubygems/fluentd
0.14.13..* - rubygems/fluentd
0.14.14..* - rubygems/fluentd
0.14.14.pre.1..* - rubygems/fluentd
0.14.15..* - rubygems/fluentd
0.14.16..* - rubygems/fluentd
0.14.17..* - rubygems/fluentd
0.14.18..* - rubygems/fluentd
0.14.19..* - rubygems/fluentd
0.14.2..* - rubygems/fluentd
0.14.20..* - rubygems/fluentd
0.14.20.rc1..* - rubygems/fluentd
0.14.21..* - rubygems/fluentd
0.14.22..* - rubygems/fluentd
0.14.22.rc1..* - rubygems/fluentd
0.14.22.rc2..* - rubygems/fluentd
0.14.23..* - rubygems/fluentd
0.14.23.rc1..* - rubygems/fluentd
0.14.24..* - rubygems/fluentd
0.14.25..* - rubygems/fluentd
0.14.3..* - rubygems/fluentd
0.14.4..* - rubygems/fluentd
0.14.5..* - rubygems/fluentd
0.14.6..* - rubygems/fluentd
0.14.7..* - rubygems/fluentd
0.14.8..* - rubygems/fluentd
0.14.9..* - rubygems/fluentd
1.0.0..* - rubygems/fluentd
1.0.0.rc1..* - rubygems/fluentd
1.0.1..* - rubygems/fluentd
1.0.2..* - rubygems/fluentd
1.1.0..* - rubygems/fluentd
1.1.1..* - rubygems/fluentd
1.1.2..* - rubygems/fluentd
1.1.3..* - rubygems/fluentd
1.10.0..* - rubygems/fluentd
1.10.1..* - rubygems/fluentd
1.10.2..* - rubygems/fluentd
1.10.3..* - rubygems/fluentd
1.10.4..* - rubygems/fluentd
1.11.0..* - rubygems/fluentd
1.11.1..* - rubygems/fluentd
1.11.2..* - rubygems/fluentd
1.11.3..* - rubygems/fluentd
1.11.4..* - rubygems/fluentd
1.11.5..* - rubygems/fluentd
1.12.0..* - rubygems/fluentd
1.12.0.rc1..* - rubygems/fluentd
1.12.0.rc2..* - rubygems/fluentd
1.12.1..* - rubygems/fluentd
1.12.2..* - rubygems/fluentd
1.12.3..* - rubygems/fluentd
1.12.4..* - rubygems/fluentd
1.13.0..* - rubygems/fluentd
1.13.1..* - rubygems/fluentd
1.13.2..* - rubygems/fluentd
1.13.3..* - rubygems/fluentd
1.14.0..* - rubygems/fluentd
1.14.0.rc..* - rubygems/fluentd
1.14.1..* - rubygems/fluentd
1.14.2..* - rubygems/fluentd
1.14.3..* - rubygems/fluentd
1.14.4..* - rubygems/fluentd
1.14.5..* - rubygems/fluentd
1.14.6..* - rubygems/fluentd
1.15.0..* - rubygems/fluentd
1.15.1..* - rubygems/fluentd
1.15.2..* - rubygems/fluentd
1.15.3..* - rubygems/fluentd
1.16.0..* - rubygems/fluentd
1.16.1..* - rubygems/fluentd
1.16.10..* - rubygems/fluentd
1.16.11..* - rubygems/fluentd
1.16.2..* - rubygems/fluentd
1.16.3..* - rubygems/fluentd
1.16.4..* - rubygems/fluentd
1.16.5..* - rubygems/fluentd
1.16.6..* - rubygems/fluentd
1.16.7..* - rubygems/fluentd
1.16.8..* - rubygems/fluentd
1.16.9..* - rubygems/fluentd
1.17.0..* - rubygems/fluentd
1.17.1..* - rubygems/fluentd
1.18.0..* - rubygems/fluentd
1.19.0..* - rubygems/fluentd
1.19.1..* - rubygems/fluentd
1.19.2..* - rubygems/fluentd
1.2.0..* - rubygems/fluentd
1.2.0.pre1..* - rubygems/fluentd
1.2.1..* - rubygems/fluentd
1.2.2..* - rubygems/fluentd
1.2.3..* - rubygems/fluentd
1.2.4..* - rubygems/fluentd
1.2.4.rc1..* - rubygems/fluentd
1.2.5..* - rubygems/fluentd
1.2.5.rc1..* - rubygems/fluentd
1.2.6..* - rubygems/fluentd
1.3.0..* - rubygems/fluentd
1.3.1..* - rubygems/fluentd
1.3.2..* - rubygems/fluentd
1.3.3..* - rubygems/fluentd
1.4.0..* - rubygems/fluentd
1.4.1..* - rubygems/fluentd
1.4.2..* - rubygems/fluentd
1.5.0..* - rubygems/fluentd
1.5.0.rc1..* - rubygems/fluentd
1.5.1..* - rubygems/fluentd
1.5.2..* - rubygems/fluentd
1.6.0..* - rubygems/fluentd
1.6.1..* - rubygems/fluentd
1.6.2..* - rubygems/fluentd
1.6.3..* - rubygems/fluentd
1.7.0..* - rubygems/fluentd
1.7.0.rc1..* - rubygems/fluentd
1.7.1..* - rubygems/fluentd
1.7.2..* - rubygems/fluentd
1.7.3..* - rubygems/fluentd
1.7.4..* - rubygems/fluentd
1.8.0..* - rubygems/fluentd
1.8.0.rc1..* - rubygems/fluentd
1.8.0.rc2..* - rubygems/fluentd
1.8.0.rc3..* - rubygems/fluentd
1.8.1..* - rubygems/fluentd
1.9.0..* - rubygems/fluentd
1.9.0.rc1..* - rubygems/fluentd
1.9.0.rc2..* - rubygems/fluentd
1.9.1..* - rubygems/fluentd
1.9.2..* - rubygems/fluentd
1.9.3..* - rubygems/fluentd
0.10.0..* - rubygems/fluentd
0.10.1..* - rubygems/fluentd
0.10.10..* - rubygems/fluentd
0.10.11..* - rubygems/fluentd
0.10.12..* - rubygems/fluentd
0.10.13..* - rubygems/fluentd
0.10.15..* - rubygems/fluentd
0.10.16..* - rubygems/fluentd
0.10.17..* - rubygems/fluentd
0.10.18..* - rubygems/fluentd
0.10.19..* - rubygems/fluentd
0.10.2..* - rubygems/fluentd
0.10.20..* - rubygems/fluentd
0.10.21..* - rubygems/fluentd
0.10.22..* - rubygems/fluentd
0.10.23..* - rubygems/fluentd
0.10.24..* - rubygems/fluentd
0.10.25..* - rubygems/fluentd
0.10.26..* - rubygems/fluentd
0.10.27..* - rubygems/fluentd
0.10.28..* - rubygems/fluentd
0.10.29..* - rubygems/fluentd
0.10.3..* - rubygems/fluentd
0.10.30..* - rubygems/fluentd
0.10.31..* - rubygems/fluentd
0.10.32..* - rubygems/fluentd
0.10.33..* - rubygems/fluentd
0.10.34..* - rubygems/fluentd
0.10.35..* - rubygems/fluentd
0.10.36..* - rubygems/fluentd
0.10.37..* - rubygems/fluentd
0.10.38..* - rubygems/fluentd
0.10.39..* - rubygems/fluentd
0.10.4..* - rubygems/fluentd
0.10.40..* - rubygems/fluentd
0.10.41..* - rubygems/fluentd
0.10.42..* - rubygems/fluentd
0.10.43..* - rubygems/fluentd
0.10.44..* - rubygems/fluentd
0.10.45..* - rubygems/fluentd
0.10.46..* - rubygems/fluentd
0.10.47..* - rubygems/fluentd
0.10.48..* - rubygems/fluentd
0.10.49..* - rubygems/fluentd
0.10.5..* - rubygems/fluentd
0.10.50..* - rubygems/fluentd
0.10.51..* - rubygems/fluentd
0.10.52..* - rubygems/fluentd
0.10.53..* - rubygems/fluentd
0.10.54..* - rubygems/fluentd
0.10.55..* - rubygems/fluentd
0.10.56..*
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
OracleCommunications
Cloud Native Core Security Edge Protection Proxy 25.2.201Cloud Native Core Security Edge Protection Proxy 26.1.200MetaSolv Solution Module 70.0.0Operations Monitor 6.1Service Catalog and Design 8.0-8.3Unified Assurance 6.1.1-7.0.0Unified Assurance 7.0.0Metrics
Show all metrics
Severity
critical
104.19
no public PoC known
9.8
Published
2026-07-14 08:42 UTC
CWE-22
Weakness classes (CWE)
CWE-22Base
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
cwe.mitre.org →
References & sources
- https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3web
- https://github.com/fluent/fluentdpackage
- https://github.com/fluent/fluentd/releases/tag/v1.19.3web
- https://github.com/fluent/fluentd/pull/5391x_refsource_MISC
- https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-44024web