Loading vulnerability…
Path Traversal in Fluent Bit File Output Plugin
CVE-2025-12972 is a path traversal vulnerability in Fluent Bit's out_file output plugin. When the File configuration option is omitted, the plugin derives output filenames from record tags without adequately sanitizing them. An attacker who controls tags reaching this output can inject traversal sequences to write or overwrite files outside the intended output directory, subject to the agent's filesystem permissions. Exploitation can enable log tampering and, in suitable configurations, remote code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can compromise filesystem and logging integrity by directing output to unintended files and potentially overwriting existing data. Remote code execution is possible if attacker-influenced output can modify files subsequently executed or loaded by another component. The potential scope depends on Fluent Bit's privileges, writable filesystem locations, available mounts, and the attacker's control over written records; code execution is not an unconditional consequence.
If you can’t patch tonight, do this now.
Explicitly configure a fixed File value rather than deriving output filenames from untrusted tags. Use static, predefined tags and restrict network access to input plugins that accept attacker-controlled records. Run Fluent Bit as a non-root user, restrict writable filesystem access to necessary output directories, and mount configuration files read-only. Setting an output directory alone should not be relied on to prevent traversal.
Patch, then assume compromise.
Upgrade Fluent Bit to version 4.2.0 or a later supported release containing the fix. For deployments remaining on older branches, vendor-listed fixed releases include 4.1.1 and the 4.0.14 backport. Review file-output configurations and investigate unexpected filesystem modifications, since updating does not undo a prior compromise.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.