{"id":"CVE-2026-92709","kind":"vulnerability","aliases":["CVE-2026-92709"],"related":[],"title":"rsyslog: dynaFile templates let untrusted input write logs outside intended directory","description":"Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.","summary":"Rsyslog's omfile dynaFile feature builds output file paths from templates, and an untrusted value used as a path component can make the rendered path escape the intended log directory. An attacker who controls such input can write files to arbitrary locations the rsyslog process can reach.","severity":"high","cvss":8.1,"epss":0.00452,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","log-server","rsyslog","self-hosted"],"not_affected_if":["fixed-file-paths","no-dynafile","no-untrusted-input"],"how_to_check":"- Run `rsyslogd -v` to get the installed version and compare it with the affected range 1.15.0 to 8.2610.0.\n- Search rsyslog configuration for `dynaFile` or `$template` lines used as file paths in `omfile` actions, and check whether any path component contains values from network-received messages such as the HOSTNAME field.","fix":"- Upgrade rsyslog past the affected range; the fixed version is unknown from the sources, as no public patch existed at publication.\n- Until patched, avoid using untrusted fields like HOSTNAME or message content in dynaFile path templates, and use fixed file names or sanitize values in the template.","status":"open","published_at":"2026-10-22T14:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:05:52+00:00","updated_at":"2026-10-25T03:05:52+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:05:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade rsyslog past the affected range; the fixed version is unknown from the sources, as no public patch existed at publication.\n- Until patched, avoid using untrusted fields like HOSTNAME or message content in dynaFile path templates, and use fixed file names or sanitize values in the template.","reach":"network","title":"rsyslog: dynaFile templates let untrusted input write logs outside intended directory","impact":"high","summary":"Rsyslog's omfile dynaFile feature builds output file paths from templates, and an untrusted value used as a path component can make the rendered path escape the intended log directory. An attacker who controls such input can write files to arbitrary locations the rsyslog process can reach.","category":"infrastructure","nicknames":[],"who_cares":["rsyslog","linux","log-server","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker writes files outside the log directory with rsyslog privileges.","analyst_note":"Check the NVD entry and the rsyslog project advisory for the fixed version and whether a patch has since been released.","how_to_check":"- Run `rsyslogd -v` to get the installed version and compare it with the affected range 1.15.0 to 8.2610.0.\n- Search rsyslog configuration for `dynaFile` or `$template` lines used as file paths in `omfile` actions, and check whether any path component contains values from network-received messages such as the HOSTNAME field.","needs_analyst":true,"not_affected_if":["fixed-file-paths","no-dynafile","no-untrusted-input"],"who_is_affected":"Systems running rsyslog from 1.15.0 through 8.2610.0 that use omfile with dynaFile templates where a path component is built from untrusted input received over the network. Deployments that write to fixed log file paths only, or that do not accept untrusted log input, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":3472,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92709':14A,17A '1.15.0':86C '8.2610.0':88C 'allow':95C 'arbitrari':67B 'attack':58B 'avail':187C 'becom':120C 'build':32B 'compon':46B,136C,174C 'condit':178C 'configur':145C 'control':60B 'creat':176C 'cve':12A,15A 'deploy':105C,119C 'differ':110C 'directori':11A,56B,111C,156C 'dynafil':2A,30B,92C,124C,172C 'dynam':114C 'escap':52B,150C 'explicit':138C 'facil':93C 'fast':79C 'featur':31B 'field':165C 'file':34B,65B,116C 'flexibl':99C 'generat':98C,115C 'handl':142C 'host':26B 'hostnam':164C 'influenc':129C 'infrastructur':18B 'input':6A,62B,132C 'intend':10A,54B,154C 'intent':94C 'let':4A 'limit':160C 'linux':19B 'locat':68B 'log':8A,21B,55B,82C,108C,155C 'log-serv':20B 'make':48B 'name':117C 'omfil':29B,91C 'oper':152C 'output':33B,100C 'outsid':9A 'patch':188C 'path':35B,45B,51B,101C,135C,141C,148C,173C 'process':71B,83C 'public':182C,186C 'reach':73B,170C 'render':50B,147C 'rfc5424':163C 'rocket':78C 'rocket-fast':77C 'rout':107C 'rsyslog':1A,23B,27B,70B,74C,89C 'secur':140C 'secure-path':139C 'self':25B 'self-host':24B 'server':22B 'support':103C 'system':80C 'templat':3A,37B,96C,125C 'time':180C 'unsaf':121C 'untrust':5A,40B,131C,167C 'use':42B,113C,126C 'valid':104C 'valu':41B,128C,168C 'version':85C 'without':137C 'write':7A,64B","nicknames":[],"mitigations":[],"who_affected":"Systems running rsyslog from 1.15.0 through 8.2610.0 that use omfile with dynaFile templates where a path component is built from untrusted input received over the network. Deployments that write to fixed log file paths only, or that do not accept untrusted log input, are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T14:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92709","severity":null,"published_at":"2026-10-22T14:17:51+00:00","modified_at":"2026-10-22T17:29:28+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92709","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92709","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}