Path Traversal in Fluent Fluentd
CVE-2026-44024
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient vali…
Vulnerability class: Path Traversal (Directory Traversal)
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Fluent Fluentd — versions < 1.19.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-44024?
- CVE-2026-44024 is a critical-severity vulnerability in Fluent Fluentd, classified under Path Traversal. CVSS score: 9.8/10. Published 2026-07-08.
- How severe is CVE-2026-44024?
- Critical severity. CVSS v3 base score is 9.8 out of 10.