CVE-2026-33466

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.

• CWE-22

• https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816Mitigation, Vendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3346IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerab…6.4
• CVE-2026-33460Incorrect Authorization (CWE-863) in Kibana can lead to cros…4.3
• CVE-2026-33461Incorrect Authorization (CWE-863) in Kibana can lead to info…6.5
• CVE-2026-33462A path traversal vulnerability was identified in Kibana's da…7.3
• CVE-2026-33463Operation on a Resource after Expiration or Termination (CWE…5.3
• CVE-2026-33464Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-33467Improper Verification of Cryptographic Signature (CWE-347) i…5.9
• CVE-2026-33468Kysely is a type-safe TypeScript SQL query builder. Prior to…8.1
• CVE-2026-33469Frigate is a network video recorder (NVR) with realtime loca…6.5
• CVE-2026-3347The Multi Functional Flexi Lightbox plugin for WordPress is …5.5
• CVE-2026-33470Frigate is a network video recorder (NVR) with realtime loca…4.3
• CVE-2026-33471nimiq-block contains block primitives to be used in Nimiq's …9.6