Every CVE Search/ Get API key

CVE-2026-92709

Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

8.1 HighFix available

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.38%Down 0.1 points since Oct 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Record
CVE-2026-92709
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-73
Updated
2026-11-02
EUVDEUVD-2026-108168 8.1

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Record
EUVD-2026-108168
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 8.1

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Record
CVE-2026-92709
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-73
Updated
2026-11-02
OSV 8.1

Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Record
CVE-2026-92709
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-73
Updated
2026-11-06
OSVDEBIAN-CVE-2026-92709 8.1

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Record
DEBIAN-CVE-2026-92709
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-92709 8.1

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Record
UBUNTU-CVE-2026-92709
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVAZL-111473 No score

CVE-2026-92709 affecting package rsyslog 8.2308.0-7

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

Record
AZL-111473
Updated
2026-11-05
OSVopenSUSE-SU-2026:12349-1 No score

rsyslog-8.2608.0-4.1 on GA media

These are all security issues fixed in the rsyslog-8.2608.0-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12349-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22184-1 No score

Security update for rsyslog

This update for rsyslog fixes the following issues:

  • CVE-2026-19654: imptcp regex-framing remote denial of service (bsc#1271910).
  • CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite (bsc#1272414).
  • CVE-2026-78002: RainerScript replace() heap buffer overflow (bsc#1275926).
  • CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926).
  • RainerScript replace() length wrap (bsc#1285036).

Changes for rsyslog:

  • added new rsyslog (imdtls/omdtls) DTLS modules (jsc#PED-16623)
  • upgrade to rsyslog 8.2608.0 (bsc#1257604)
  • 2026-08-18: imbeats: rearm listener after failed TLS accept
  • 2026-08-18: msg: serialize turbo snapshot duplication
  • 2026-08-18: omfile: harden dynafile default containment
  • 2026-08-18: fixup! omfwd: support PKCS#11 URIs with ossl TLS
  • 2026-07-02: omfwd: support PKCS#11 URIs with ossl TLS
  • 2026-07-21: mmkubernetes: reload SA token proactively and on HTTP 401
  • 2026-08-17: devtools: remove Cubic from local validation
  • 2026-08-14: mmnormalize: share turbo $! snapshot across MsgDup by refcount
  • 2026-08-11: tcpsrv: synchronize session table slots
  • 2026-08-11: imrelp: preserve errno across stop signal
  • 2026-08-12: examples.rst: Missing space in template
  • 2026-08-10: mmnormalize: merge debug metadata
  • 2026-08-08: normalizers: complete debug test gating
  • 2026-08-08: normalizers: complete debug integration
  • 2026-08-07: mmnormalize, pmnormalize: add liblognorm debugging
  • 2026-08-07: msg: ignore null values in msgSetPropViaJSON() instead of crashing
  • 2026-08-07: runtime: make error-message flag atomic
  • 2026-07-24: fuzz: exercise RFC 3164 and RFC 5424 parsers
  • 2026-08-05: build: unify indentation in AC_CONFIG_FILES list
  • 2026-07-25: imfile: fix delay.message microsecond conversion
  • 2026-07-24: diskqueue: reject symlinked persisted segments
  • 2026-06-23: omfile: control symlink following
  • 2026-07-25: mmnormalize: make HUP reload worker-safe
  • 2026-07-24: docs(agents): add Cursor Cloud environment setup notes
  • 2026-07-22: imbeats: harden Lumberjack input resource handling
  • 2026-07-23: stringbuf: harden empty string replacement
  • 2026-07-20: imptcp: guard regex framing match at line start (CVE-2026-19654 bsc#1271910)
  • 2026-07-21: rainerscript: free cnfstmtNewAct nvlst once, at the done: label
  • 2026-07-21: queue: preserve DA child work during shutdown
  • 2026-07-21: imtcp: release completed zlib decoder state
  • 2026-07-09: doc: clarify JSON array rendering
  • 2026-07-21: Potential fixes for 5 code quality findings (#7397)
  • 2026-07-20: ratelimit: optimize port-based per-source keys
  • 2026-07-20: imtcp: make zstd window budget configurable
  • 2026-07-19: imtcp: use snake case for zstd window tracking
  • 2026-07-17: imtcp: bound aggregate zstd decoder window memory
  • 2026-07-20: statsobj: guard Prometheus escape writes
  • 2026-07-18: config: do not instantiate actions disabled via config.enabled="off"
  • 2026-07-15: queue: document DA engine internals
  • 2026-07-14: msg: enforce source-property helper contract
  • 2026-07-10: ratelimit: remove per-source key policy hot lock
  • 2026-07-08: ratelimit: speed source-key shortcuts
  • 2026-07-15: queue: clarify DA transfer worker role
  • 2026-07-18: compat_queue: add missing STAILQ_FOREACH/STAILQ_NEXT fallback
  • 2026-07-18: rainerscript: warn on constant AND/OR operand at parse time
  • 2026-07-18: configure: include <stddef.h> in the STAILQ detection test
  • 2026-07-17: mmnormalize: share Turbo CEE root path check
  • 2026-07-17: mmnormalize: fall back after Turbo materialization failure
  • 2026-07-17: mmnormalize: preserve turbo results across message boundaries
  • 2026-07-17: benchmarks: harden comparison and helper inputs
  • 2026-07-16: segdisk: optimize CRC accounting and add benchmarks
  • 2026-07-15: imjournal: stop invalidation reopen…
Record
openSUSE-SU-2026:22184-1
Updated
2026-11-02
OSVSUSE-SU-2026:5082-1 No score

Security update for rsyslog

This update for rsyslog fixes the following issues:

  • CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926).
  • RainerScript replace() length wrap (bsc#1285036).
Record
SUSE-SU-2026:5082-1
Updated
2026-11-03
OSVSUSE-SU-2026:5089-1 No score

Security update for rsyslog

This update for rsyslog fixes the following issues:

  • CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926).
  • RainerScript replace() length wrap (bsc#1285036).
Record
SUSE-SU-2026:5089-1
Updated
2026-11-04
OSVSUSE-SU-2026:5100-1 No score

Security update for rsyslog

This update for rsyslog fixes the following issues:

  • CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926).
  • RainerScript replace() length wrap (bsc#1285036).
Record
SUSE-SU-2026:5100-1
Updated
2026-11-05
OSVSUSE-SU-2026:5122-1 No score

Security update for rsyslog

This update for rsyslog fixes the following issues:

  • CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926).
  • RainerScript replace() length wrap (bsc#1285036).
Record
SUSE-SU-2026:5122-1
Updated
2026-11-06

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rsyslog
Azure Linux:3
 through 8.2308.0-7 None known
rsyslog
Debian:12
 All versions, plus listed versions
8.2302.0-18.2302.0-1+deb12u18.2304.0-18.2306.0-18.2306.0-2
Show 45 moreShow less
8.2308.0-18.2310.0-18.2310.0-28.2310.0-38.2310.0-48.2312.0-18.2312.0-28.2312.0-38.2402.0-18.2404.0-18.2404.0-28.2406.0-18.2408.0-18.2408.0-28.2410.0-18.2412.0-18.2412.0-28.2502.0-18.2502.0-28.2502.0-38.2502.0-48.2502.0-58.2502.0-68.2504.0-18.2506.0-18.2506.0-28.2506.0-38.2506.0-48.2506.0-68.2510.0-18.2510.0-28.2510.0-38.2510.0-48.2510.0-58.2512.0-18.2512.0-28.2512.0-38.2602.0-18.2604.0-18.2604.0-28.2604.0-38.2604.0-48.2606.0-18.2606.0-28.2606.0-3
 None known
rsyslog
Debian:13
 All versions, plus listed versions
8.2504.0-18.2504.0-1+deb13u18.2504.0-1+deb13u28.2506.0-18.2506.0-2
Show 25 moreShow less
8.2506.0-38.2506.0-48.2506.0-68.2510.0-18.2510.0-28.2510.0-38.2510.0-48.2510.0-58.2512.0-18.2512.0-28.2512.0-38.2602.0-18.2604.0-18.2604.0-28.2604.0-38.2604.0-48.2606.0-18.2606.0-28.2606.0-38.2606.0-48.2608.0-18.2608.0-28.2608.0-38.2608.0-48.2610.0-1
 None known
rsyslog
Debian:14
 All versions, plus listed versions
8.2504.0-18.2506.0-18.2506.0-28.2506.0-38.2506.0-4
Show 23 moreShow less
8.2506.0-68.2510.0-18.2510.0-28.2510.0-38.2510.0-48.2510.0-58.2512.0-18.2512.0-28.2512.0-38.2602.0-18.2604.0-18.2604.0-28.2604.0-38.2604.0-48.2606.0-18.2606.0-28.2606.0-38.2606.0-48.2608.0-18.2608.0-28.2608.0-38.2608.0-48.2610.0-1
 None known
rsyslog
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 8.2608.0-150700.3.29.1
8.2608.0-150700.3.29.1
rsyslog
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 8.2608.0-150700.3.29.1
8.2608.0-150700.3.29.1
rsyslog
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 8.2608.0-150700.3.29.1
8.2608.0-150700.3.29.1
rsyslog
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 8.2106.0-8.30.2
8.2106.0-8.30.2
rsyslog
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 8.2106.0-8.30.2
8.2106.0-8.30.2
rsyslog
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 8.2406.0-150600.12.30.1
8.2406.0-150600.12.30.1
Show 19 moreShow less
Affected packages
PackageAffectedFixed
rsyslog
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 8.2406.0-150600.12.30.1
8.2406.0-150600.12.30.1
rsyslog
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 8.2306.0-150400.5.51.1
8.2306.0-150400.5.51.1
rsyslog
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 8.2306.0-150400.5.51.1
8.2306.0-150400.5.51.1
rsyslog
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 8.2306.0-150400.5.51.1
8.2306.0-150400.5.51.1
rsyslog
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 8.2306.0-150400.5.51.1
8.2306.0-150400.5.51.1
rsyslog
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 8.2306.0-150400.5.51.1
8.2306.0-150400.5.51.1
rsyslog
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 8.2306.0-150400.5.51.1
8.2306.0-150400.5.51.1
rsyslog
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 8.2306.0-150400.5.51.1
8.2306.0-150400.5.51.1
rsyslog
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 8.2306.0-150400.5.51.1
8.2306.0-150400.5.51.1
rsyslog
Ubuntu:14.04:LTS
 All versions, plus listed versions
5.8.11-2ubuntu47.4.4-1ubuntu17.4.4-1ubuntu27.4.4-1ubuntu2.17.4.4-1ubuntu2.37.4.4-1ubuntu2.57.4.4-1ubuntu2.67.4.4-1ubuntu2.7
 None known
rsyslog
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
8.12.0-1ubuntu28.12.0-1ubuntu38.14.0-2ubuntu18.14.0-2ubuntu28.16.0-1ubuntu1
Show 6 moreShow less
8.16.0-1ubuntu28.16.0-1ubuntu38.16.0-1ubuntu3.18.16.0-1ubuntu3.1+esm18.16.0-1ubuntu3.1+esm28.16.0-1ubuntu3.1+esm3
 None known
rsyslog
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8.16.0-1ubuntu98.16.0-1ubuntu108.32.0-1ubuntu38.32.0-1ubuntu48.32.0-1ubuntu4.28.32.0-1ubuntu4.2+esm1
 None known
rsyslog
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
8.1901.0-1ubuntu48.2001.0-1ubuntu18.2001.0-1ubuntu1.18.2001.0-1ubuntu1.38.2001.0-1ubuntu1.3+esm1
 None known
rsyslog
Ubuntu:22.04:LTS
 All versions, plus listed versions
8.2102.0-2ubuntu28.2110.0-3ubuntu18.2110.0-3ubuntu28.2110.0-4ubuntu18.2112.0-2ubuntu28.2112.0-2ubuntu2.28.2112.0-2ubuntu2.48.2112.0-2ubuntu2.5
 None known
rsyslog
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.2306.0-2ubuntu28.2312.0-3ubuntu18.2312.0-3ubuntu28.2312.0-3ubuntu38.2312.0-3ubuntu7
Show 6 moreShow less
8.2312.0-3ubuntu88.2312.0-3ubuntu98.2312.0-3ubuntu9.18.2312.0-3ubuntu9.28.2312.0-3ubuntu9.38.2312.0-3ubuntu9.4
 None known
rsyslog
Ubuntu:26.10
 All versions, plus listed versions
8.2512.0-1ubuntu48.2512.0-1ubuntu58.2608.0-4ubuntu18.2608.0-4ubuntu28.2608.0-4ubuntu3
 None known
rsyslog
Ubuntu:26.04:LTS
 All versions, plus listed versions
8.2504.0-1ubuntu28.2512.0-1ubuntu28.2512.0-1ubuntu38.2512.0-1ubuntu48.2512.0-1ubuntu4.18.2512.0-1ubuntu4.2
 None known
rsyslog
openSUSE:Tumbleweed
 before 8.2608.0-4.1
8.2608.0-4.1
rsyslog
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 8.2608.0-160000.1.1
8.2608.0-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-92709 is a high vulnerability (CVSS 8.1) in Rsyslog, published October 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in rsyslog 8.2608.0-150700.3.29.1.

References

Show 17 moreShow less
This page doesn't list everything

Left out here: 6 versions and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open