CVE-2026-77621

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77621
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77621.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77621
Aliases
  • GHSA-6342-xwvw-c637
Published
2026-09-22T15:19:19Z
Modified
2026-09-23T03:48:03Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Vector: Arbitrary file write in the file sink via templated path (path traversal).
Details

Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path template, the value can contain an absolute path or parent-directory traversal, causing Vector to create parent directories and create or overwrite files outside the intended location with the Vector process privileges. The resulting file write can modify sensitive files and can lead to code execution when a scheduled task, authorization file, or subsequently executed script is targeted. This issue is fixed in version 0.57.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77621.json"
}
References

Affected packages

Git / github.com/vectordotdev/vector

Affected ranges

Type
GIT
Repo
https://github.com/vectordotdev/vector
Events
Introduced
0f0311aebc4124eb06759633f4d4a9f098b36f07
Fixed
8832452f57afb536ea0de53a093f9fd1b669ccec
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.10.0"
        },
        {
            "fixed":  "0.57.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77621.json"