Path Traversal in Fluentbit Fluent Bit
CVE-2025-12972
Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.009 (58.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 58.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.009 · change: +0.001
Affected products
- Fluentbit Fluent Bit — versions 0
- Treasuredata Fluent Bit — versions 4.1.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-12972?
- CVE-2025-12972 is a medium-severity vulnerability in Fluentbit Fluent Bit, classified under Path Traversal. CVSS score: 5.3/10. Published 2025-11-24.
- How severe is CVE-2025-12972?
- Medium severity. CVSS v3 base score is 5.3 out of 10.