Directory Traversal Vulnerability in Vector by Vector.dev

CVE-2026-77621

What is CVE-2026-77621?

The Vector observability data pipeline has a directory traversal vulnerability present in versions 0.10.0 to 0.57.0. This flaw stems from the file sink's ability to render a templated path from event fields without proper confinement to the intended directory. When an attacker can provide an untrusted source for the event fields, it allows them to manipulate the path template. This manipulation can result in absolute paths or a traversal of parent directories, enabling unauthorized file creation or overwriting in locations that should be protected, leveraging Vector’s process privileges. Consequently, this could lead to the modification of sensitive files or potentially allow arbitrary code execution if targeted scripts or files are manipulated. Users are advised to upgrade to version 0.57.0, where this issue has been resolved.

References