Log in Start free

Vulnerability · Published Oct 22, 2026 · Assigned by GitHub_M

CVE-2026-92709Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

High 8.1

In plain English

A high-severity path traversal in rsyslog from rsyslog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 68.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rsyslogno fix listedDEBIAN-CVE-2026-92709
Debian:13rsyslogno fix listedDEBIAN-CVE-2026-92709
Debian:14rsyslogno fix listedDEBIAN-CVE-2026-92709
Ubuntu:22.04:LTSrsyslogno fix listedUBUNTU-CVE-2026-92709
Ubuntu:24.04:LTSrsyslogno fix listedUBUNTU-CVE-2026-92709
Ubuntu:26.04:LTSrsyslogno fix listedUBUNTU-CVE-2026-92709
Ubuntu:26.10rsyslogno fix listedUBUNTU-CVE-2026-92709

Affected products (as reported)

VendorProductVersions
rsyslog rsyslog >= 1.15.0, <= 8.2610.0

Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References