CVE-2026-92709
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Rsyslog is a fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, allowing the rendered path to escape the intended log directory. This is not limited to the RFC5424 HOSTNAME field. At time of publication, there are no publicly available patches.
Risk Assessment
Untrusted data in a dynaFile path can allow files to be written outside the intended log directory, potentially overwriting or creating unwanted files. The lack of patches increases risk for deployments using dynaFile with untrusted values.
Recommendation
Review dynaFile templates and ensure no value derived from untrusted input is used as a path component without secure handling. Monitor vendor information while awaiting a fix.
Other vulnerabilities in Rsyslog
See all- CVE-2026-61548High
In Rsyslog from 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a parameter larger than the buffer, causing an attacker-controlled stack overwrite. This is fixed in version 8.2606.0.
- CVE-2026-55556High
In Rsyslog from 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. This is fixed in version 8.2604.0.
- CVE-2026-78002High
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.
- CVE-2026-19654High
An unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality, integrity, privilege escalation, or code execution impact has been identified.
Original NVD description (English source)
Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS