CVE-2025-12972

CVE-2025-12972 is a path traversal vulnerability in the Fluent Bit out_file plugin, affecting treasuredata fluent_bit. Attackers with network access can manipulate untrusted tag input to craft file paths, enabling them to write files outside the intended directory. This medium-severity vulnerability (CVSS 5.3) requires no user interaction and has a low impact on integrity, with no impact on confidentiality or availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.