CVE-2026-92709

A flaw was found in rsyslog. This path traversal vulnerability allows a remote attacker to write log files outside the intended logging directory. When dynamic file generation (dynaFile) templates incorporate untrusted input without proper path validation, crafted log messages can escape the designated path. An attacker can exploit this condition to create or overwrite files in arbitrary locations on the host system.

This vulnerability is rated as Important severity because exploitation can allow an unauthenticated remote entity to manipulate file paths and create or modify files with rsyslog privileges, which may lead to remote code execution. In default Red Hat Enterprise Linux installations, rsyslog routes events to fixed destination files and does not listen on the network. The flaw only poses a risk in deployments configured to dynamically generate target file paths based on untrusted log fields without sanitization.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue without upgrading:

1. Audit rsyslog configurations in /etc/rsyslog.conf and /etc/rsyslog.d/*.conf for any omfile definitions utilizing dynaFile templates. Modify dynamic path templates to use fixed directories and static filenames, or apply rsyslog property-replacer regex filters to strip directory separator characters (/ and \) and directory traversal sequences (..).

2. Restrict network access to rsyslog endpoints (UDP/TCP port 514) to trusted hosts or management networks using firewall rules:

firewall-cmd --permanent --remove-service=syslog
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>
firewall-cmd --permanent --zone=trusted --add-port=514/tcp
firewall-cmd --permanent --zone=trusted --add-port=514/udp
firewall-cmd --reload

3. Restart the rsyslog daemon to apply configuration changes:

systemctl restart rsyslog

Caveats: Replacing dynamic file paths with static files will aggregate logs across hosts into shared files, which may impact existing log parsing and rotation scripts. Restarting or reloading the rsyslog service will cause a momentary interruption in log reception, during which unbuffered incoming network logs could be dropped.