CVE-2026-92709: Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE
Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Only deployments whose omfile dynaFile template places an untrusted, input-influenced value in a path component without explicit secure-path handling are affected. The untrusted value is not limited to the RFC5424 HOSTNAME field.
What does an attacker need to exploit this?
An attacker needs to control a value that reaches a dynaFile-generated path component in the target rsyslog configuration. The issue is remotely reachable and requires neither privileges nor user interaction, but exploitation has high attack complexity.
Are default rsyslog configurations affected?
The available information identifies the vulnerable condition as configuration-dependent: it requires an unsafe dynaFile template. No information is provided confirming that a default configuration uses such a template.
What can be done while no patch is available?
Review omfile dynaFile templates and ensure untrusted input cannot be used as a path component unless explicit secure-path handling is applied. Avoid using externally controlled fields, including but not limited to RFC5424 HOSTNAME, to construct output paths.
How can I determine whether my configuration is affected?
Inspect rsyslog omfile dynaFile templates for path components built from values that may originate in untrusted log input. A configuration is at risk if such values can render paths outside the intended log directory without explicit secure-path handling.