CVE-2025-12972

Published Nov 24, 2025

Last updated 7 days ago

Fluent Bit

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-12972 is a path traversal vulnerability found in the Fluent Bit out_file plugin. The vulnerability stems from the plugin's failure to properly sanitize tag values when deriving output file names, specifically when the 'File' option is omitted. In such cases, the plugin uses untrusted tag input to construct file paths. This vulnerability allows attackers with network access to craft tags containing path traversal sequences (e.g., "../"), which can cause Fluent Bit to write files outside the intended output directory. By exploiting this flaw, attackers can overwrite arbitrary files on the disk, leading to log tampering and potentially remote code execution.

Description: Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory.
Source: cret@cert.org
NVD status: Modified
Products: fluent_bit

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4D0EA105-B741-4E44-828A-9300B09A7A79"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.