CVE-2026-33466

CVE-2026-33466 is a path traversal vulnerability in Logstash's archive extraction functionality that fails to properly validate file paths within compressed archives. This flaw allows attackers to write arbitrary files to the host filesystem with Logstash process privileges, and potentially achieve remote code execution if automatic pipeline reloading is enabled. The vulnerability can be exploited through a compromised or attacker-controlled update endpoint by serving a specially crafted malicious archive. The vulnerability carries a critical CVSS score of 9.8, indicating a network-exploitable flaw requiring no authentication, user interaction, or special privileges. The attack has low complexity and impacts confidentiality, integrity, and availability across the entire system. With an EPSS score of 0.004, this CVE currently has lower predicted exploitation probability compared to the average vulnerability. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows no signs of active exploitation in the wild. No public exploit code appears to be readily available, and community attention remains limited based on the inactive status on the Hot List. However, organizations running Logstash with automatic pipeline reloading enabled should prioritize patching due to the critical severity rating and potential for remote code execution.