https://seclists.org/oss-sec/2026/q3/529: rsyslog: omfile dynaFile containment hardening (GHSA-xmp9-244p-5ggv)
Published Aug 20, 2026
·Updated
Affected Software
1 affected component
rsyslog omfile output module (dynaFile)
Assess rsyslog configurations that use the omfile module with dynaFile, particularly where dynamic values can influence output paths. Deployments that intentionally allow paths outside a single static base directory are the relevant compatibility-sensitive cases.
Where rsyslog can determine a static base path, the hardening adds default lexical containment. Earlier flexible behavior remained the default to avoid breaking existing logging configurations and did not provide a clear warning about path-containment risk.
The hardening provides an explicit per-action compatibility opt-in for configurations that intentionally require path escape. This preserves the needed flexible behavior without making it the implicit default for applicable actions.
Use the documented secure configuration mechanisms to constrain dynamic output paths. Those mechanisms were already the recommended approach for dynaFile configurations.
Review omfile actions that use dynaFile and determine whether their generated filenames must remain under a static base path or intentionally escape it. The current hardening also adds diagnostics for the relevant dynamic-filename handling.