CVE-2026-77621
Received Received - Intake

Path Traversal in Vector Observability Pipeline

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path template, the value can contain an absolute path or parent-directory traversal, causing Vector to create parent directories and create or overwrite files outside the intended location with the Vector process privileges. The resulting file write can modify sensitive files and can lead to code execution when a scheduled task, authorization file, or subsequently executed script is targeted. This issue is fixed in version 0.57.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-77621
EUVD
EUVD-2026-84510

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
vectordotdev vector From 0.10.0 (inc) to 0.57.0 (inc)
vectordotdev vector 0.57.0
vector vector to 0.57.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Vector, a data pipeline tool, from versions 0.10.0 to 0.57.0. It allows untrusted event data to control file paths via templated routing. Attackers can inject absolute paths or directory traversal sequences into these templates, causing Vector to create or overwrite files outside intended directories with its process privileges. This can lead to sensitive file modification and potential code execution if targeted files are used by other systems.

Detection Guidance

Check Vector configuration files for sinks using templated paths without a fixed literal prefix. Look for errors in Vector logs related to confinement failures or template rendering issues. Use commands like 'vector validate --config /etc/vector/vector.yaml' to verify configurations.

Impact Analysis

If exploited, this vulnerability could allow attackers to write arbitrary files to your system with Vector's privileges. This might include modifying configuration files, overwriting critical system files, or creating files that trigger code execution when processed by other applications. It could also lead to data leakage if files are written to unintended locations.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized file writes might expose sensitive data or allow tampering with logs and records, potentially resulting in compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade Vector to version 0.57.0 or later. Review and update all sink configurations to include a fixed literal prefix in templated paths. Set 'base_dir' for file sinks if the path template lacks a usable prefix. Avoid using 'dangerously_allow_unconfined_template_resolution' unless absolutely necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart