{"schema":"threatline.record/2","record":{"id":"CVE-2026-67224","aliases":["GHSA-h7cq-qrr8-7vgc"],"summary":"RabbitMQ: Admin path-traversal write via trace name","details":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDir, Name ++ \".log\") where Name comes from PUT /api/traces/:vhost/:name. No safe_relative_path / traversal check is applied on the write side, while the read side (rabbit_tracing_files.erl) does call rabbit_misc:safe_relative_path/1 , proving the omission is an oversight, not design. The .log suffix is forced and the endpoint requires administrator. A user with the administrator tag can write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user via the tracing plugin's name parameter, e.g. /etc/cron.d/x.log (if writable) or overwrite existing .log files outside the trace directory. Preconditions include rabbitmq_tracing plugin enabled administrator tag Target path writable by rabbitmq OS user. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.","categories":["Unclassified"],"product":"rabbitmq-server","vendor":"rabbitmq","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67224","source_modified_at":"2026-09-24T15:20:07.691Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"rabbitmq-server","vendor":"rabbitmq","versions":[{"status":"affected","version":">= 3.13.0, < 3.13.15"},{"status":"affected","version":">= 4.0.0, < 4.0.20"},{"status":"affected","version":">= 4.1.0, < 4.1.11"},{"status":"affected","version":">= 4.2.0, < 4.2.6"},{"status":"affected","version":">= 4.3.0, < 4.3.1"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"range":">= 3.13.0, < 3.13.15"},{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"range":">= 4.0.0, < 4.0.20"},{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"range":">= 4.1.0, < 4.1.11"},{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"range":">= 4.2.0, < 4.2.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"range":">= 4.3.0, < 4.3.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"version":"3.13.15"},{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"version":"4.0.20"},{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"version":"4.1.11"},{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"version":"4.2.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source_modified_at":"2026-07-29T15:03:46Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"other","name":"rabbitmq-server"},"version":"4.3.1"}],"cvss":2.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00355,"percentile":0.28016,"score_date":"2026-10-23"},"published_at":"2026-09-23T20:05:04.923Z","modified_at":"2026-09-24T15:20:07.691Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-67224","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-24T15:20:07.691Z"},{"source":"GitHub Advisory Database","url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-07-29T15:03:46Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-67224","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-24T15:19:57.876579Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-24T15:20:07.691Z","content_hash":"562cbd3b5fba8e4a0e56868f06754bb3d3c8cedfcf5811edb1a33109a0212442"}}