CVE-2025-12977: Path Traversal
CVE-2025-12977
Other sources
Fluent Bit inhttp, insplunk, and inelasticsearch input plugins fail to sanitize tagkey inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tagkey values containing special characters such as newlines or ../ that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, impacting data integrity and log routing.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12977?
CVE-2025-12977 is classified as a medium severity vulnerability due to its potential for input validation issues.
How do I fix CVE-2025-12977?
To mitigate CVE-2025-12977, update Fluent Bit to the latest version that includes patches for the input plugins in_http, in_splunk, and in_elasticsearch.
Who is affected by CVE-2025-12977?
CVE-2025-12977 affects users of Fluent Bit utilizing the in_http, in_splunk, and in_elasticsearch input plugins.
What types of inputs are vulnerable in CVE-2025-12977?
CVE-2025-12977 is vulnerable to inputs that contain unvalidated tag_key values, such as special characters including newlines or ../ in tag keys.
Can CVE-2025-12977 be exploited remotely?
Yes, CVE-2025-12977 can be exploited remotely by attackers with network access or the ability to write records into Splunk or Elasticsearch.