CVE-2026-33466 is a high severity (CVSS 8.1) path traversal in Elastic Logstash archive extraction. A crafted archive from a compromised update endpoint can write files anywhere the process can, and may lead to code execution. Fixed versions are 8.19.14, 9.2.8 and 9.3.3.
What's affected
- Product: Elastic Logstash.
- Affected: 8.0.0 through 8.19.13, 9.0.0 through 9.2.7, and 9.3.0 through 9.3.2.
- Fixed: 8.19.14, 9.2.8 and 9.3.3.
- Affected configuration: the GeoIP database downloader is enabled and pulls from an external update endpoint.
How to check if you're exposed
Check your Logstash version:
bin/logstash --version
Then see whether the GeoIP downloader is active. Look for xpack.geoip.downloader.enabled in logstash.yml. Also check whether automatic pipeline reloading is on, since that is the step that can turn a file write into code execution.
Paste a lockfile or manifest into the free in-browser dependency scan to see whether Logstash is in your tree. The Gold directory tracks this CVE, and reachability analysis helps you rank it against everything else you have open.
What to do now
- Upgrade to 8.19.14, 9.2.8 or 9.3.3, or a later release.
- If you do not need the GeoIP downloader, set
xpack.geoip.downloader.enabledto false. The Elastic advisory presents this as a complete fix. - If you keep it, use HTTPS and a trusted update source, and turn off automatic pipeline reloading.
- Limit the filesystem paths the Logstash process can write to.
- Look for files written outside the GeoIP directory, changed pipeline configs, and downloads from unexpected endpoints.
Why it matters
Logstash extracts compressed archives without validating the paths stored inside them. An entry with a relative path can climb out of the intended folder and land elsewhere on disk. That is CWE-22, path traversal, in its archive form, sometimes called zip slip.
The attacker needs to control the update endpoint, which is why the attack complexity is high. If pipeline auto reload is on, a dropped config file can run as a new pipeline. This CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I avoid CVE-2026-33466 without upgrading?
Elastic says disabling the GeoIP downloader (xpack.geoip.downloader.enabled set to false) removes the exposure. Upgrading is still the lasting fix.
Sources
- https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816
- https://nvd.nist.gov/vuln/detail/CVE-2026-33466
Last reviewed: 19 October 2026.
