External risk intelligence

Logstash Arbitrary File Write via Archive Path Traversal.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-33466

Logstash is a data processing pipeline typically deployed within internal network segments for log aggregation and transformation. It is generally not designed to be directly exposed to the public internet, and the requirement for an attacker to control an update endpoint further suggests that public-internet exposure is not a standard or common deployment pattern.

Path Traversal

Elastic Logstash

8.0.0 to before 8.19.149.0.0 to before 9.2.89.3.0 to before 9.3.3

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Logstash could allow an attacker to write to arbitrary files on the system, potentially leading to code execution. This issue arises from how Logstash handles file paths within compressed archives, particularly when automatic pipeline reloading is enabled. While the primary concern is confirming relevance, this could impact systems running Logstash if they are exposed to malicious archives.

Logstash can be tricked into writing files anywhere.
Critical flaw could allow attackers to run code.
Confirm if Logstash is exposed and needs review.

Attack Path

How an attacker could exploit the issue

An attacker could achieve arbitrary file writes and potentially remote code execution by tricking Logstash into extracting a specially crafted archive. This involves an attacker controlling a Logstash update endpoint to serve a malicious archive, which Logstash then processes without properly validating file paths. If Logstash is configured to automatically reload pipelines, this vulnerability can be leveraged for remote code execution.

Attacker controls update endpoint.
Logstash extracts malicious archive.
Leads to arbitrary file write or RCE.

Live Threat

Current exploitation, exposure, and threat context

When Logstash is configured to accept crafted archives from a compromised or attacker-controlled update endpoint, an attacker could write arbitrary files to the host filesystem with the privileges of the Logstash process. This could lead to remote code execution if automatic pipeline reloading is enabled.

Logstash process files and system.
Attacker-controlled update endpoint serves malicious archive.
Arbitrary file write leading to code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Logstash, a data processing pipeline, requires careful ownership by platform or infrastructure teams, with security and network teams playing a crucial role in managing its exposure and attack surface. The first actionable step involves identifying all Logstash deployments, assessing their reachability and business criticality, and then confirming the accountable owner to prioritize remediation efforts.

Platform teams should own the issue.
Verify Logstash network exposure and update endpoints.
Plan vendor coordination and phased patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Logstash and how is it used?

Logstash is an open-source data processing pipeline used to collect, transform, and ship data from various sources to storage systems like Elasticsearch. It acts as a central hub for log aggregation, filtering, and parsing, which helps teams maintain visibility into their system performance and security data by preparing raw logs for analysis.

What is the vulnerability behind CVE-2026-33466?

This CVE involves Improper Limitation of a Pathname to a Restricted Directory, known as CWE-22. In plain English, the software fails to properly check file paths inside compressed archives before extracting them. An attacker can exploit this by crafting a file that uses 'relative path traversal' to write files outside of the intended directory and into sensitive areas of the host system.

How does an attacker trigger this vulnerability?

An attacker must successfully serve a specially crafted archive file to Logstash through an update endpoint they control or have compromised. If the attacker cannot influence the update mechanism to provide this malicious archive, the vulnerability is not triggered. Simply running Logstash with standard, trusted data sources does not expose the system to this specific extraction flaw.

Is my Logstash instance at risk?

Halo Surface Signal indicates that Logstash is typically deployed within internal network segments for data processing rather than being directly exposed to the public internet. Because the attack requires control over an update endpoint, instances isolated from untrusted networks or those that do not fetch updates from external sources face a lower risk profile compared to those with broad network access.

How should I respond to this threat?

Begin by identifying all running Logstash deployments and determining which team is responsible for managing them. Prioritize systems that have update endpoints reachable by external or untrusted traffic. Once identified, coordinate with your infrastructure team to update Logstash to a patched version, as this is the only way to ensure the archive extraction utility correctly validates file paths.

References

discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-20…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.