CVE-2026-77621

Name of the Vulnerable Software and Affected Versions Vector versions 0.10.0 through 0.56.0

Description The file sink renders its templated path from event fields and opens the result without confining it to an intended directory. If an untrusted source provides an event field used by the path template, the value may contain an absolute path or parent-directory traversal. This allows the application to create parent directories and create or overwrite files outside the intended location using the privileges of the Vector process. Such file writes can modify sensitive files and potentially lead to code execution if a scheduled task, authorization file, or subsequently executed script is targeted.

Recommendations Update to version 0.57.0.