CVE-2025-12972
📋 TL;DR
CVE-2025-12972 is a path traversal vulnerability in Fluent Bit's out_file plugin that allows attackers to write files outside the intended output directory by crafting malicious tag values. This affects Fluent Bit deployments where the File option is omitted and untrusted input can reach the logging pipeline. Organizations using Fluent Bit for log collection from untrusted sources are at risk.
💻 Affected Systems
- Fluent Bit
📦 What is this software?
Fluent Bit by Treasuredata
⚠️ Risk & Real-World Impact
Worst Case
Attackers could overwrite critical system files, install backdoors, or achieve remote code execution by writing malicious scripts to executable locations.
Likely Case
Attackers write arbitrary files to sensitive directories, potentially leading to data corruption, denial of service, or privilege escalation.
If Mitigated
With proper input validation and directory restrictions, impact is limited to file writes within controlled directories.
🎯 Exploit Status
Exploitation requires network access to inject malicious tags into Fluent Bit's input pipeline.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.0 or 4.0.3
Vendor Advisory: https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/
Restart Required: Yes
Instructions:
1. Download Fluent Bit 4.1.0 or 4.0.3 from official sources. 2. Stop Fluent Bit service. 3. Replace binary with patched version. 4. Restart Fluent Bit service.
🔧 Temporary Workarounds
Explicit File Parameter
allAlways specify explicit File parameter in out_file configuration to avoid tag-based file naming.
[OUTPUT]
Name out_file
File /var/log/fluentbit/output.log
Input Validation Filter
allAdd Lua filter to sanitize tag values before reaching out_file plugin.
[FILTER]
Name lua
Match *
script sanitize_tags.lua
call sanitize_tags
🧯 If You Can't Patch
- Restrict Fluent Bit to read-only filesystem mounts for output directories
- Implement network segmentation to limit untrusted input sources
🔍 How to Verify
Check if Vulnerable:
Check Fluent Bit version with 'fluent-bit --version' and verify out_file configuration lacks explicit File parameter.Check Version:
fluent-bit --versionVerify Fix Applied:
Confirm version is 4.1.0+ or 4.0.3+ and test with crafted tags containing '../' sequences.📡 Detection & Monitoring
Log Indicators:
- Unusual file creation patterns in system logs
- Fluent Bit errors related to file path resolution
Network Indicators:
- Suspicious tag payloads containing path traversal sequences in network traffic
SIEM Query:
source="fluent-bit" AND (tag="*../*" OR message="*path traversal*")