Brief Summary: Logstash CVE-2026-33466 Path Traversal to Remote Code Execution via GeoIP Database Downloads

Introduction

A path traversal flaw in Logstash's GeoIP database extraction logic lets an attacker write arbitrary files to the host filesystem and, under the right conditions, escalate that to remote code execution within seconds. The vulnerable GeoIP downloader is enabled by default, so any Logstash instance that has not been explicitly hardened against this vector is potentially exposed.

Technical Information

CVE-2026-33466 comes from missing file path validation during archive extraction in Logstash's GeoIP database management subsystem. It is a textbook "Zip Slip" vulnerability (classified under CWE-22 and CAPEC-139). When Logstash downloads and extracts a compressed GeoIP database archive, the extraction logic does not check whether each entry's resolved output path stays within the intended target directory. An archive with entries that contain relative path traversal sequences (e.g., ../../etc/cron.d/malicious) can escape the extraction boundary and place files anywhere the Logstash process has write access.

The Delivery Vector: GeoIP Database Downloads

Logstash has a built-in GeoIP database management feature, controlled by the xpack.geoip.downloader.enabled setting, which defaults to true. When it is on, Logstash periodically fetches updated GeoIP2 databases from the endpoint set in xpack.geoip.downloader.endpoint (by default https://geoip.elastic.co/v1/database). It polls every 24 hours by default, as set by xpack.geoip.downloader.poll.interval.

An attacker who compromises this endpoint, intercepts the download from a man-in-the-middle position, or manipulates DNS routing to redirect the request can serve a crafted archive in place of the legitimate GeoIP database update.

Attack Flow

The attacker finds a way to serve a malicious archive to the Logstash GeoIP downloader, for example by compromising the update endpoint, hijacking DNS, or using a network position that allows traffic interception.
Logstash downloads the crafted archive during its next scheduled poll.
The extraction utility unpacks the archive without validating the paths of its entries. Entries with relative path traversal sequences write files to arbitrary locations on the host filesystem, with the full privileges of the Logstash process.
If config.reload.automatic is enabled (it defaults to false), Logstash checks its pipeline configuration files for changes every 3 seconds (set by config.reload.interval). The attacker can aim the arbitrary write at a pipeline configuration file and inject a malicious pipeline definition.
Logstash detects the configuration change and reloads the modified pipeline, running the attacker's code within seconds of the file write.

Configuration Settings and Risk Context

These are the settings that matter for this vulnerability:

Setting	Default Value	Risk Context
`xpack.geoip.downloader.enabled`	`true`	Turns on the automatic download mechanism, which is the delivery vector
`xpack.geoip.downloader.endpoint`	`https://geoip.elastic.co/v1/database`	The URL Logstash fetches archives from. Compromising it enables the attack
`xpack.geoip.downloader.poll.interval`	`24h`	How often Logstash fetches new archives
`config.reload.automatic`	`false`	When enabled, creates the escalation path from file write to RCE
`config.reload.interval`	`3s`	How quickly Logstash detects and loads a modified configuration file

The two intervals are lopsided. A malicious archive can only arrive on the 24-hour download cycle, so the delivery window is narrow (once per day by default). Once the payload lands, though, the 3-second reload interval turns it into code execution almost instantly.

Patch Information

Elastic fixed CVE-2026-33466 on April 8, 2026, with coordinated releases on all three active Logstash release branches:

Release Branch	Fixed Version
8.x	8.19.14
9.2.x	9.2.8
9.3.x	9.3.3

The fix adds path validation to archive extraction. The patched extraction logic checks that every resolved output path stays strictly within the intended target directory and rejects any archive entry whose path would resolve outside it. This is the standard, well-understood defense against Zip Slip-style attacks.

Teams tracking changes should know that the public release notes for these versions (for example, the Logstash 8.19.14 release notes page) list only plugin dependency updates, such as Netty upgrades and Log4j bumps. Elastic tracks the security fix separately under Elastic Security Advisory ESA-2026-29 and does not itemize it in the standard changelog, in line with its practice of keeping security fix disclosures apart from general release notes.

All three patched releases were published to the elastic/logstash GitHub repository on April 8, 2026 (tags v8.19.14, v9.2.8, and v9.3.3), so they are available for immediate upgrade. Elastic has not publicly disclosed commit-level code diffs for this fix.

Interim Workarounds

If you cannot patch right away, these configuration changes reduce exposure:

Set xpack.geoip.downloader.enabled to false in the Logstash configuration. This stops Logstash from fetching archives from external endpoints and removes the primary delivery mechanism. You must set this explicitly in air-gapped or offline environments as well.
Do not start Logstash with config.reload.automatic enabled. This breaks the escalation path from arbitrary file write to remote code execution.
If the GeoIP downloader must stay enabled, confirm that xpack.geoip.downloader.endpoint points strictly to the official Elastic URL and that nobody has tampered with DNS resolution for that domain.

Affected Systems and Versions

All versions of Logstash before these patched releases are affected:

Logstash versions on the 8.x branch prior to 8.19.14
Logstash versions on the 9.2.x branch prior to 9.2.8
Logstash versions on the 9.3.x branch prior to 9.3.3

The vulnerability is exploitable when xpack.geoip.downloader.enabled is set to true (the default). Escalation to remote code execution also requires config.reload.automatic to be enabled (it defaults to false).

Vendor Security History

Elastic runs a transparent, structured security disclosure process. It publishes security announcements on its discussion forums, tracks advisories under a dedicated ESA numbering scheme, and deliberately keeps those advisories separate from general release notes. It also coordinates patches across its supported version branches at the same time. Shipping fixes for three active branches (8.x, 9.2.x, and 9.3.x) on the same day, as it did here, is a sign of mature incident response and patch management.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information