What is the CVSS score of EUVD-2026-20526?

EUVD-2026-20526 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Logstash are affected by EUVD-2026-20526?

Elastic Logstash versions 8.0.0 through 8.19.13 contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary code through malicious compressed…

How to fix or mitigate EUVD-2026-20526?

Within 24 hours: Identify all Logstash instances running versions 8.0.0-8.19.13 in your environment and disable automatic pipeline reloading via configuration. Within 7 days: Isolate affected Logstash servers from untrusted networks and restrict access to update endpoints; monitor Logstash logs for suspicious archive processing or file writes. Within 30 days: Contact Elastic for patch availability timeline; prepare upgrade paths to patched versions once released or implement air-gapped deployment models for high-risk instances.

Logstash EUVD-2026-20526

| CVE-2026-33466 HIGH

Path Traversal (CWE-22)

2026-04-08 elastic

GHSA-w3rv-2cr7-p2wh

Path Traversal RCE Logstash

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 23:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 18:16 euvd

EUVD-2026-20526

Analysis Generated

Apr 08, 2026 - 18:16 vuln.today

CVE Published

Apr 08, 2026 - 16:50 nvd

HIGH 8.1

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.

AnalysisAI

Remote code execution in Elastic Logstash versions 8.0.0 through 8.19.13 allows unauthenticated network attackers to write arbitrary files and execute code via malicious compressed archives. The vulnerability exploits improper path validation in archive extraction utilities, enabling attackers who compromise or control update endpoints to deliver path traversal payloads. When automatic pipeline reloading is enabled, arbitrary file writes escalate to full RCE with Logstash process privileges. CVSS 8.1 (High) with network vector but high attack complexity. EPSS data and KEV status not provided; no public exploit confirmed at time of analysis, though the technical details disclosed increase weaponization risk for environments with exposed update mechanisms.

Technical ContextAI

This vulnerability affects the archive extraction subsystem in Elastic Logstash (CPE: cpe:2.3:a:elastic:logstash), specifically versions 8.0.0 through 8.19.13. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. Logstash's archive handling code fails to sanitize file paths embedded within compressed archives (e.g., ZIP, TAR), allowing relative path sequences like '../../../' to escape intended extraction directories. This vulnerability maps to CAPEC-139 (Relative Path Traversal) attack pattern. The attack surface is the update endpoint mechanism where Logstash retrieves and extracts plugin archives or configuration updates. When Logstash processes a malicious archive containing traversal sequences, files are written outside the designated directory with the privileges of the Logstash service account. In deployments with automatic pipeline reloading enabled (a common configuration for dynamic pipeline management), attackers can overwrite pipeline configuration files (*.conf) to inject arbitrary code executed by the Logstash JRuby runtime, achieving full remote code execution.

RemediationAI

Upgrade immediately to Logstash version 8.19.14 or later, which addresses the path traversal vulnerability in archive extraction utilities per vendor advisory ESA-2026-29 (https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816). Organizations unable to apply patches immediately should implement compensating controls: disable automatic plugin updates and configure Logstash to only accept plugins from cryptographically verified internal repositories; disable automatic pipeline reloading if not operationally required to prevent file write escalation to RCE; implement network segmentation to restrict Logstash update traffic to trusted internal sources only; monitor file system activity for unexpected writes outside Logstash installation directories; and verify integrity of existing pipeline configurations and plugins if compromise is suspected. Review and harden update endpoint configurations to ensure mutual TLS authentication and certificate pinning for all plugin repository communications.