IT SBIT Services
Schneeberger
DEEN
CVE tracker

rsyslog: Path traversal via dynaFile templates in omfile

CVE-2026-92709High 8.1

← All vulnerabilities

Summary

rsyslog's omfile dynaFile feature builds output file paths from templates. If a template uses a value influenced by untrusted input as a path component without explicit secure-path handling, the rendered path can leave the intended log directory and rsyslog can create or append to files elsewhere. Exploitation requires an attacker who can influence the input, an explicitly deployed unsafe configuration, and filesystem privileges that permit the write; code execution is not representative of default configurations.

Affected

  • rsyslog versions from 1.15.0 up to and including 8.2610.0
  • Only configurations with an omfile action using dynaFile and untrusted values in path components without securepath, secpath-drop or secpath-replace
  • Default Debian and Ubuntu configurations are not affected according to the vendor

Fixed in

  • Unknown. No patched version is confirmed in the vendor advisory at time of publication.
  • Distribution status is inconsistent; verify with your distribution before relying on a fix.

Workaround

  • Apply explicit secure-path handling (securepath, secpath-drop or secpath-replace) to every untrusted value used in a dynaFile template.
  • Set global(compatibility.defaults.secure="warn") to identify affected templates, or "strict" where compatible.
  • Keep untrusted fields such as hostname and app-name out of dynaFile path templates.
  • Run rsyslog with least privileges and retain OS confinement (MAC, systemd sandboxing, filesystem permissions).

Exploitation

  • Known exploitation in the wild: no evidence found.
  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
  • Public proof of concept: unknown.

Our recommendation

  • Audit rsyslog configurations for omfile actions using dynaFile and identify any untrusted input in path components.
  • Add explicit secure-path handling to affected templates, and use the warn mode to find them.
  • Restrict which senders can reach rsyslog inputs by source IP or network.
  • Apply vendor updates once a confirmed fixed version is published and monitor the GitHub advisory.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:06.

Original description (NVD)

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed