CVE-2026-45767

Received Received - Intake

File Write Vulnerability in Suricata IDS/IPS Engine

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess `load`+ `save` rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45767

Affected Vendors & Products

Vendor	Product	Version / Range
openinfosec	suricata	to 8.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Suricata before versions 7.0.16 and 8.0.5 has a vulnerability where a malicious rule could overwrite any file on the file system during rule load or reload. This occurs because the system does not properly validate file paths in rules.

Detection Guidance

Detecting this vulnerability requires checking Suricata versions and reviewing rule files for absolute path usage. Run 'suricata -V' to check the installed version. If using versions before 7.0.16 or 8.0.5, the system is vulnerable. Inspect rule files for 'save' commands with absolute paths using commands like 'grep -r "save" /etc/suricata/rules/'.

Impact Analysis

This vulnerability allows an attacker to overwrite critical system files, potentially leading to denial of service, unauthorized access, or system compromise. It could also enable attackers to manipulate configurations or install malware.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized file access or modification, potentially exposing sensitive data or disrupting security controls required by these regulations.

Mitigation Strategies

Upgrade Suricata to versions 7.0.16 or 8.0.5 immediately. If upgrading is not possible, apply workarounds: preprocess rules to block absolute paths in 'save' commands, use Suricata's privilege dropping to limit writable files, or configure landlock in suricata.yaml to restrict file access.

Hi! I’m here to help you understand CVE-2026-45767. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70