CVE-2026-77621 in Vector
Summary
by MITRE • 09/22/2026
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path template, the value can contain an absolute path or parent-directory traversal, causing Vector to create parent directories and create or overwrite files outside the intended location with the Vector process privileges. The resulting file write can modify sensitive files and can lead to code execution when a scheduled task, authorization file, or subsequently executed script is targeted. This issue is fixed in version 0.57.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
Vector serves as a high-performance observability data pipeline designed to collect, transform, and route telemetry data across distributed systems. A critical security vulnerability was identified within the file sink component of Vector versions ranging from 0.10.0 through 0.57.0. This flaw stems from an insecure implementation of path resolution logic where the software dynamically constructs file paths based on event fields provided by upstream sources. The core technical deficiency lies in the failure to confine these dynamically generated paths within a predefined, intended directory structure. Instead of validating or sanitizing the input against a strict allowlist or applying canonicalization checks that prevent escape sequences, Vector directly renders the templated path using raw field values. This architectural oversight allows an attacker who controls the content of specific event fields to manipulate the resulting file system operations significantly beyond their authorized scope.
The operational impact of this vulnerability is severe due to its potential for arbitrary file write and subsequent code execution. When an untrusted source supplies a maliciously crafted value in an event field that feeds into the path template, the attacker can inject absolute paths or utilize parent-directory traversal sequences such as dot-dot-slash. Upon receiving such input, Vector does not restrict the output location to its configured base directory. Instead, it proceeds to create any necessary parent directories and writes data to the specified target file with the privileges of the running Vector process. This capability effectively grants an attacker write access to arbitrary locations on the host system where Vector is deployed, provided those locations are writable by the user account executing the service.
The consequences of this unrestricted file creation extend far beyond simple data corruption or denial of service. By targeting sensitive configuration files, authorization databases, or scheduled task definitions, an attacker can alter system behavior and persist their presence within the environment. More critically, if the attacker can target a script that is executed by another process with higher privileges, they achieve remote code execution on the host machine. This escalation path transforms what might initially appear as a data integrity issue into a full compromise of the underlying infrastructure. The vulnerability aligns closely with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-94 Improper Control of Generation of Code, reflecting both the directory traversal aspect and the potential for code injection through file manipulation.
From an adversary perspective, this flaw facilitates techniques documented in the MITRE ATT&CK framework, specifically those related to persistence via scheduled tasks or service creation, as well as defense evasion by modifying system files to hide malicious activity. The ability to write arbitrary files allows attackers to plant web shells, modify cron jobs for persistent access, or overwrite critical binaries and configuration files to disrupt operations or escalate privileges further. Because Vector often runs with elevated permissions in production environments to facilitate broad data collection, the attack surface is particularly dangerous.
To mitigate this risk, organizations running affected versions of Vector must upgrade immediately to version 0.57.0 or later, where the path resolution logic has been corrected to enforce strict confinement within the intended directory structure. Until an upgrade can be performed, administrators should implement network-level controls to restrict access to Vector endpoints and ensure that only trusted sources are permitted to send data into the pipeline. Additionally, running Vector with the principle of least privilege by using a dedicated user account with minimal file system permissions can reduce the blast radius if exploitation occurs. Regular auditing of input fields used in path templates is also recommended to identify any other potential vectors for similar vulnerabilities within custom configurations or extensions.