1. Home
  2. CVE Database
  3. CVE-2025-12972
MEDIUM · 5.3

CVE-2025-12972

Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This all...

Vulnerability Description

Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
TreasuredataFluent Bit4.1.0

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2025-12972?

CVE-2025-12972 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This all...

How severe is CVE-2025-12972?

CVE-2025-12972 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-12972?

Check the references section above for vendor advisories and patch information. Affected products include: Treasuredata Fluent Bit.