PT-2026-31346 · Elastic · Logstash

Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-33466

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Logstash (affected versions not specified)

Description Logstash is susceptible to a flaw where improper validation of file paths within compressed archives can lead to arbitrary file write and potential remote code execution through Relative Path Traversal (CAPEC-139). The archive extraction utilities do not adequately validate file paths. An attacker who can provide a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In configurations with automatic pipeline reloading enabled, this could escalate to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-LOGSTASH-2026-33466

CVE-2026-33466

Affected Products

Logstash

References · 6

• https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-logstash-2026-33466 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33466 · Security Note
• https://twitter.com/geeknik/status/2043032616408891644 · Twitter Post
• https://twitter.com/autumn_good_35/status/2042600480174752037 · Twitter Post
• https://twitter.com/CVEnew/status/2041975627293589690 · Twitter Post