CVE-2023-41044
Partial path traversal vulnerability in Support Bundle feature of Graylog
Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory. The default data_dir in operating system packages (DEB, RPM) is set to /var/lib/graylog-server. The data directory for the Support Bundle feature is always <data_dir>/support-bundle. Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a /var/lib/graylog-server/support-bundle directory name. The vulnerability would allow the download or deletion of files in the following example directories: /var/lib/graylog-server/support-bundle-test and /var/lib/graylog-server/support-bundlesdirectory. For the Graylog Docker images, the data_dir is set to /usr/share/graylog/data by default. This vulnerability is fixed in Graylog version 5.1.3 and later. Users are advised to upgrade. Users unable to upgrade should block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog. GET /api/system/debug/support/bundle/download/{filename} and DELETE /api/system/debug/support/bundle/{filename}.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Partial path traversal vulnerability in Support Bundle feature of Graylog
Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory. The default data_dir in operating system packages (DEB, RPM) is set to /var/lib/graylog-server. The data directory for the Support Bundle feature is always <data_dir>/support-bundle. Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a /var/lib/graylog-server/support-bundle directory name. The vulnerability would allow the download or deletion of files in the following example directories: /var/lib/graylog-server/support-bundle-test and /var/lib/graylog-server/support-bundlesdirectory. For the Graylog Docker images, the data_dir is set to /usr/share/graylog/data by default. This vulnerability is fixed in Graylog version 5.1.3 and later. Users are advised to upgrade. Users unable to upgrade should block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog. GET /api/system/debug/support/bundle/download/{filename} and DELETE /api/system/debug/support/bundle/{filename}.
- Record
CVE-2023-41044- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2023-1928
Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory. The default data_dir in operating system packages (DEB, RPM) is set to /var/lib/graylog-server. The data directory for the Support Bundle feature is always <data_dir>/support-bundle. Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a /var/lib/graylog-server/support-bundle directory name. The vulnerability would allow the download or deletion of files in the following example directories: /var/lib/graylog-server/support-bundle-test and /var/lib/graylog-server/support-bundlesdirectory. For the Graylog Docker images, the data_dir is set to /usr/share/graylog/data by default. This vulnerability is fixed in Graylog version 5.1.3 and later. Users are advised to upgrade. Users unable to upgrade should block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog. GET /api/system/debug/support/bundle/download/{filename} and DELETE /api/system/debug/support/bundle/{filename}.
- Record
EUVD-2023-1928- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2q4p-f6gf-mqr5
Graylog server has partial path traversal vulnerability in Support Bundle feature
A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource.
Thanks to weiweiwei9811 for reporting this vulnerability and providing detailed information.
Impact
Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory.
The default data_dir in operating system packages (DEB, RPM) is set to /var/lib/graylog-server. The data directory for the Support Bundle feature is always <data_dir>/support-bundle.
Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a /var/lib/graylog-server/support-bundle directory name.
The vulnerability would allow the download or deletion of files in the following example directories.
/var/lib/graylog-server/support-bundle-test/var/lib/graylog-server/support-bundlesdirectory
For the Graylog and Graylog Enterprise Docker images, the data_dir is set to /usr/share/graylog/data by default.
Patches
The vulnerability is fixed in Graylog version 5.1.3 and later.
Workarounds
Block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog.
GET /api/system/debug/support/bundle/download/{filename}DELETE /api/system/debug/support/bundle/{filename}
- Record
GHSA-2q4p-f6gf-mqr5- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory. The default data_dir in operating system packages (DEB, RPM) is set to /var/lib/graylog-server. The data directory for the Support Bundle feature is always <data_dir>/support-bundle. Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a /var/lib/graylog-server/support-bundle directory name. The vulnerability would allow the download or deletion of files in the following example directories: /var/lib/graylog-server/support-bundle-test and /var/lib/graylog-server/support-bundlesdirectory. For the Graylog Docker images, the data_dir is set to /usr/share/graylog/data by default. This vulnerability is fixed in Graylog version 5.1.3 and later. Users are advised to upgrade. Users unable to upgrade should block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog. GET /api/system/debug/support/bundle/download/{filename} and DELETE /api/system/debug/support/bundle/{filename}.
- Record
CVE-2023-41044- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Partial path traversal vulnerability in Support Bundle feature of Graylog
Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory. The default data_dir in operating system packages (DEB, RPM) is set to /var/lib/graylog-server. The data directory for the Support Bundle feature is always <data_dir>/support-bundle. Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a /var/lib/graylog-server/support-bundle directory name. The vulnerability would allow the download or deletion of files in the following example directories: /var/lib/graylog-server/support-bundle-test and /var/lib/graylog-server/support-bundlesdirectory. For the Graylog Docker images, the data_dir is set to /usr/share/graylog/data by default. This vulnerability is fixed in Graylog version 5.1.3 and later. Users are advised to upgrade. Users unable to upgrade should block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog. GET /api/system/debug/support/bundle/download/{filename} and DELETE /api/system/debug/support/bundle/{filename}.
- Record
CVE-2023-41044- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-2q4p-f6gf-mqr5
Graylog server has partial path traversal vulnerability in Support Bundle feature
A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource.
Thanks to weiweiwei9811 for reporting this vulnerability and providing detailed information.
Impact
Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory.
The default data_dir in operating system packages (DEB, RPM) is set to /var/lib/graylog-server. The data directory for the Support Bundle feature is always <data_dir>/support-bundle.
Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a /var/lib/graylog-server/support-bundle directory name.
The vulnerability would allow the download or deletion of files in the following example directories.
/var/lib/graylog-server/support-bundle-test/var/lib/graylog-server/support-bundlesdirectory
For the Graylog and Graylog Enterprise Docker images, the data_dir is set to /usr/share/graylog/data by default.
Patches
The vulnerability is fixed in Graylog version 5.1.3 and later.
Workarounds
Block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog.
GET /api/system/debug/support/bundle/download/{filename}DELETE /api/system/debug/support/bundle/{filename}
- Record
GHSA-2q4p-f6gf-mqr5- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.graylog2:graylog2-serverMaven |
5.1.0 up to 5.1.3 | 5.1.3 |
org.graylog2:graylog2-serverMaven |
5.1.0 up to 5.1.3, plus listed versions 5.1.15.1.2 |
5.1.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | shoucheng3/Graylog2__graylog2-server_CVE-2023-41044_5-1-2 | 2025-08-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41044 is a low vulnerability (CVSS 3.3) in Graylog, published July 6, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in org.graylog2:graylog2-server 5.1.3.
References
github.com/Graylog2/graylog2-server/security/advisories/GHSA-2q4p-f6gf-mqr5
go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm
nvd.nist.gov/vuln/detail/CVE-2023-41044