{"id":"GHSA-2q4p-f6gf-mqr5","summary":"Graylog server has partial path traversal vulnerability in Support Bundle feature","details":"A partial path traversal vulnerability exists in Graylog's [Support Bundle](https://go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm) feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource.\n\nThanks to weiweiwei9811 for reporting this vulnerability and providing detailed information.\n\n### Impact\n\nGraylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory.\n\nThe default `data_dir` in operating system packages (DEB, RPM) is set to `/var/lib/graylog-server`. The data directory for the Support Bundle feature is always `\u003cdata_dir\u003e/support-bundle`.\n\nDue to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a `/var/lib/graylog-server/support-bundle` directory name.\n\nThe vulnerability would allow the download or deletion of files in the following example directories.\n\n- `/var/lib/graylog-server/support-bundle-test`\n- `/var/lib/graylog-server/support-bundlesdirectory`\n\nFor the [Graylog](https://hub.docker.com/r/graylog/graylog) and [Graylog Enterprise](https://hub.docker.com/r/graylog/graylog-enterprise) Docker images, the `data_dir` is set to `/usr/share/graylog/data` by default.\n\n### Patches\n\nThe vulnerability is fixed in Graylog version 5.1.3 and later.\n\n### Workarounds\n\n\nBlock all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog.\n\n- `GET /api/system/debug/support/bundle/download/{filename}`\n- `DELETE /api/system/debug/support/bundle/{filename}`\n","aliases":["CVE-2023-41044"],"modified":"2026-09-10T03:49:42.560047113Z","published":"2023-07-06T20:53:15Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2023-07-06T20:53:15Z","nvd_published_at":"2023-08-31T18:15:09Z","cwe_ids":["CWE-22"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-2q4p-f6gf-mqr5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41044"},{"type":"WEB","url":"https://github.com/Graylog2/graylog2-server/commit/02b8792e6f4b829f0c1d87fcbf2d58b73458b938"},{"type":"PACKAGE","url":"https://github.com/Graylog2/graylog2-server"},{"type":"WEB","url":"https://go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm"}],"affected":[{"package":{"name":"org.graylog2:graylog2-server","ecosystem":"Maven","purl":"pkg:maven/org.graylog2/graylog2-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.3"}]}],"versions":["5.1.0","5.1.1","5.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-2q4p-f6gf-mqr5/GHSA-2q4p-f6gf-mqr5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"}]}