---
id: "CVE-2026-92709"
kind: "vulnerability"
aliases: ["CVE-2026-92709"]
title: "rsyslog: dynaFile templates let untrusted input write logs outside intended directory"
severity: "high"
cvss: 8.1
epss: 0.00452
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux", "log-server", "rsyslog", "self-hosted"]
not_affected_if: ["fixed-file-paths", "no-dynafile", "no-untrusted-input"]
published_at: "2026-10-22T14:17:51+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:05:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92709", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-92709", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# rsyslog: dynaFile templates let untrusted input write logs outside intended directory

Rsyslog's omfile dynaFile feature builds output file paths from templates, and an untrusted value used as a path component can make the rendered path escape the intended log directory. An attacker who controls such input can write files to arbitrary locations the rsyslog process can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `rsyslogd -v` to get the installed version and compare it with the affected range 1.15.0 to 8.2610.0.
- Search rsyslog configuration for `dynaFile` or `$template` lines used as file paths in `omfile` actions, and check whether any path component contains values from network-received messages such as the HOSTNAME field.

## Fix

- Upgrade rsyslog past the affected range; the fixed version is unknown from the sources, as no public patch existed at publication.
- Until patched, avoid using untrusted fields like HOSTNAME or message content in dynaFile path templates, and use fixed file names or sanitize values in the template.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92709
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-92709

## From the sources

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_