CVE-2026-44024

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.

• CWE-22

• https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437Patch
• https://github.com/fluent/fluentd/pull/5391Issue Tracking, Patch
• https://github.com/fluent/fluentd/releases/tag/v1.19.3Product, Release Notes
• https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3Mitigation, Vendor Advisory

Published

Jul 8, 2026

Last Modified

Jul 13, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44018Docling simplifies document processing by parsing diverse fo…7.1
• CVE-2026-44019Docling Core defines core data types and transformations for…8.1
• CVE-2026-4402Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-44020Docling simplifies document processing by parsing diverse fo…7.5
• CVE-2026-44022Docling simplifies document processing by parsing diverse fo…5.5
• CVE-2026-44023Docling Core defines core data types and transformations for…8.6
• CVE-2026-44025Fluentd collects events from various data sources and writes…7.5
• CVE-2026-44028An issue was discovered in Nix before 2.34.7 and Lix before …7.5
• CVE-2026-44029An issue was discovered in Nix before 2.34.7. Writing to arb…5.3
• CVE-2026-4404Use of hard coded credentials in GoHarbor Harbor version 2.1…9.4
• CVE-2026-44040UltraVNC through 1.8.2.2 uses a cryptographically weak pseud…6.5
• CVE-2026-44041UltraVNC through 1.8.2.2 contains an out-of-bounds read in t…6.5