CVE-2026-44024— Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44024
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
Source: NVD (National Vulnerability Database)
Vulnerability Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44024
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7374 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-44024
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-44024 (2)
Vendor Advisories for CVE-2026-44024 (1)
Vendor Pages for CVE-2026-44024 (1)
Same Patch Batch · fluent · 2026-07-08 · 4 CVEs total
| CVE-2026-44025 | 7.5 HIGH | Fluentd: Exposure of Sensitive Information via Monitor Agent API |
| CVE-2026-44160 | 7.5 HIGH | Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward` |
| CVE-2026-44161 | 7.2 HIGH | Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http` |
IV. Related Vulnerabilities
Same product: fluentd
- CVE-2026-44161
Fluentd: Server-Side Request Forgery (SSRF) via Placeholder - CVE-2026-44160
Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb - CVE-2026-44025
Fluentd: Exposure of Sensitive Information via Monitor Agent - CVE-2022-39379
Fluentd vulnerable to remote code execution due to insecure - CVE-2021-41186
ReDoS vulnerability in parser_apache2
Same vendor: fluent
- CVE-2026-44161
Fluentd: Server-Side Request Forgery (SSRF) via Placeholder - CVE-2026-44160
Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb - CVE-2026-44025
Fluentd: Exposure of Sensitive Information via Monitor Agent - CVE-2022-39379
Fluentd vulnerable to remote code execution due to insecure - CVE-2021-41186
ReDoS vulnerability in parser_apache2
Same weakness: CWE-22
- CVE-2026-55852
Frappe: TarSlip RCE in Package Import - CVE-2026-42219
Frappe: Path Traversal via /backups Route - CVE-2026-41482
Frappe: Possible Path Traversal and Local File Inclusion via - CVE-2026-58499
Path traversal in EverOS /api/v1/memory/add via unvalidated - CVE-2026-55469
Snipe-IT: Path traversal vulnerability via CSV import `image
V. Comments for CVE-2026-44024
No comments yet