Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Vector may write files outside intended folder

CVE-2026-77621 · published 1 day ago
Summary

Versions of Vector from 0.10.0 up to 0.57.0 let a crafted event control the file path used for logging, allowing creation or overwriting of files anywhere the program runs. This could modify important system files or scripts and potentially lead to unauthorized code execution. Upgrade to Vector 0.57.0 or later to stop the unsafe file handling.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
vectordotdev vector >= 0.10.0, < 0.57.0
Original advisory text
Vector: Arbitrary file write in the file sink via templated path (path traversal).
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path template, the value can contain an absolute path or parent-directory traversal, causing Vector to create parent directories and create or overwrite files outside the intended location with the Vector process privileges. The resulting file write can modify sensitive files and can lead to code execution when a scheduled task, authorization file, or subsequently executed script is targeted. This issue is fixed in version 0.57.0.
References
Severity
8.3 High
Type
CWE-22Path Traversal
CWE-73External Control of File Name or Path
Timeline
Published22 Sep 2026
Updated23 Sep 2026
First seen22 Sep 2026
Sources
CVE-2026-77621 · NVD
CVE-2026-77621 · MITRE
CVE-2026-77621 · OSV
GHSA-6342-xwvw-c637 · GHSA
Track software like this
Free during beta