Live › vulnerability › CVE-2026-92709
Go to dashboardRsyslog's omfile dynaFile feature builds output file paths from templates, and an untrusted value used as a path component can make the rendered path escape the intended log directory. An attacker who controls such input can write files to arbitrary locations the rsyslog process can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running rsyslog from 1.15.0 through 8.2610.0 that use omfile with dynaFile templates where a path component is built from untrusted input received over the network. Deployments that write to fixed log file paths only, or that do not accept untrusted log input, are not exposed by this flaw.
No product ranges from the sources yet.
rsyslogd -v to get the installed version and compare it with the affected range 1.15.0 to 8.2610.0.dynaFile or $template lines used as file paths in omfile actions, and check whether any path component contains values from network-received messages such as the HOSTNAME field.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.
This page as .md · .json · in your agent: get_signal("CVE-2026-92709")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.