Path Traversal in Fluentbit Fluent Bit
CVE-2025-12972
Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to cr…
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.007 (46.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Fluentbit Fluent Bit — versions 0
- Treasuredata Fluent_bit — versions 4.1.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-12972?
- CVE-2025-12972 is a medium-severity vulnerability in Fluentbit Fluent Bit, classified under Path Traversal. CVSS score: 5.3/10. Published 2025-11-24.
- How severe is CVE-2025-12972?
- Medium severity. CVSS v3 base score is 5.3 out of 10.