A path traversal vulnerability in Elastic Logstash allows unauthenticated attackers to write arbitrary files to the host system, potentially leading to remote code execution.

The application fails to properly validate file paths during archive extraction, which allows an unauthenticated attacker to perform path traversal. By providing a crafted archive to a monitored endpoint, an attacker can overwrite files on the host filesystem and execute arbitrary code if pipeline reloading is enabled.

Successful exploitation results in full compromise of the Logstash host, as an attacker can write malicious files to sensitive directories. With a CVSS score of 8.1, this represents a high risk to data integrity and system availability, potentially enabling lateral movement within the network. The ability to achieve remote code execution poses a severe threat to the confidentiality and stability of the entire logging infrastructure.

Immediate Action: Upgrade to Logstash version 8.19.14 or newer, as specified in the Elastic security advisory ESA-2026-29.

Proactive Monitoring: Review system logs for unusual file write events, particularly in directories outside of expected Logstash data paths. Monitor for unauthorized modifications to configuration files or pipeline definitions.

Compensating Controls: Ensure that Logstash instances are not exposed to untrusted networks and restrict access to update endpoints to known, secure sources. Implement file system permissions that limit the write capabilities of the Logstash service user.

Public Exploit Available: exploit_available (unknown)

Given the high severity of this vulnerability and the potential for remote code execution, organizations should prioritize patching all affected Logstash instances immediately. Verify that the updated version is successfully deployed and review system configurations to ensure that pipeline reloading features are secured.