CVE-2015-4152: Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows r...

Security readout for executives and security teams

Older Logstash versions could let attacker-controlled log data change where the file output plugin writes files. In the wrong configuration, this means a remote sender might write outside the intended log directory. The sources identify Logstash before 1.4.3 and do not provide CVSS scoring. Exposure is most likely where Logstash before 1.4.3 uses the file output plugin with dynamic field references in path values influenced by remote input. Deployments not using that plugin, not using dynamic paths, or already upgraded are less likely exposed. Prioritize remediation if legacy Logstash is still running in production, especially on systems ingesting untrusted logs. The main business risk is unauthorized file creation or overwrite on log processing hosts, which can affect integrity and potentially support further compromise depending on permissions. Mitigation focus: Upgrade affected Logstash deployments to 1.4.3 or later vendor-supported versions.; Review file output plugin configurations for dynamic field references in path options.; Avoid using attacker-controlled event fields in output file paths..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.