Arbitrary Code Injection Affecting fluentd package, versions <1.19.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary Code Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUBY-FLUENTD-17660641
- published27 Jun 2026
- disclosed26 Jun 2026
- crediteverping
Introduced: 26 Jun 2026
NewCVE-2026-44024 (opens in a new tab)How to fix?
Upgrade fluentd to version 1.19.3 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Code Injection via the path parameter in output plugins when using the ${tag} placeholder. An attacker can overwrite arbitrary files or inject malicious content by sending specially crafted log entries containing path traversal sequences, which can lead to execution of attacker-controlled code. This is only exploitable if the ${tag} placeholder is used in file configurations and tags are accepted from untrusted sources.
Workaround
This vulnerability can be mitigated by restricting network access to trusted sources, running the process as a non-root user, avoiding the use of the ${tag} placeholder in file paths when tags are untrusted, and filtering incoming tags to block dangerous characters.