Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-n1wk-3vex-7yay
Vulnerability ID VCID-n1wk-3vex-7yay
Aliases CVE-2023-41044
GHSA-2q4p-f6gf-mqr5
GMS-2023-1860
Summary Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory. The default `data_dir` in operating system packages (DEB, RPM) is set to `/var/lib/graylog-server`. The data directory for the Support Bundle feature is always `<data_dir>/support-bundle`. Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a `/var/lib/graylog-server/support-bundle` directory name. The vulnerability would allow the download or deletion of files in the following example directories: `/var/lib/graylog-server/support-bundle-test` and `/var/lib/graylog-server/support-bundlesdirectory`. For the Graylog Docker images, the `data_dir` is set to `/usr/share/graylog/data` by default. This vulnerability is fixed in Graylog version 5.1.3 and later. Users are advised to upgrade. Users unable to upgrade should block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog. `GET /api/system/debug/support/bundle/download/{filename}` and `DELETE /api/system/debug/support/bundle/{filename}`.
Status Published
Exploitability 0.5
Weighted Severity 3.0
Risk 1.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00294 https://api.first.org/data/v1/epss?cve=CVE-2023-41044
epss 0.00294 https://api.first.org/data/v1/epss?cve=CVE-2023-41044
epss 0.00294 https://api.first.org/data/v1/epss?cve=CVE-2023-41044
epss 0.00294 https://api.first.org/data/v1/epss?cve=CVE-2023-41044
cvssv3.1_qr LOW https://github.com/advisories/GHSA-2q4p-f6gf-mqr5
cvssv3.1 3.3 https://github.com/Graylog2/graylog2-server
generic_textual LOW https://github.com/Graylog2/graylog2-server
cvssv3.1 3.3 https://github.com/Graylog2/graylog2-server/commit/02b8792e6f4b829f0c1d87fcbf2d58b73458b938
generic_textual LOW https://github.com/Graylog2/graylog2-server/commit/02b8792e6f4b829f0c1d87fcbf2d58b73458b938
ssvc Track https://github.com/Graylog2/graylog2-server/commit/02b8792e6f4b829f0c1d87fcbf2d58b73458b938
cvssv3.1 3.3 https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-2q4p-f6gf-mqr5
cvssv3.1_qr LOW https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-2q4p-f6gf-mqr5
generic_textual LOW https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-2q4p-f6gf-mqr5
ssvc Track https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-2q4p-f6gf-mqr5
cvssv3.1 3.3 https://go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm
generic_textual LOW https://go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm
ssvc Track https://go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm
cvssv3.1 3.3 https://nvd.nist.gov/vuln/detail/CVE-2023-41044
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2023-41044
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-41044
https://github.com/Graylog2/graylog2-server
https://nvd.nist.gov/vuln/detail/CVE-2023-41044
02b8792e6f4b829f0c1d87fcbf2d58b73458b938 https://github.com/Graylog2/graylog2-server/commit/02b8792e6f4b829f0c1d87fcbf2d58b73458b938
cluster_support_bundle.htm https://go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm
GHSA-2q4p-f6gf-mqr5 https://github.com/advisories/GHSA-2q4p-f6gf-mqr5
GHSA-2q4p-f6gf-mqr5 https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-2q4p-f6gf-mqr5
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/Graylog2/graylog2-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/Graylog2/graylog2-server/commit/02b8792e6f4b829f0c1d87fcbf2d58b73458b938
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-27T13:05:23Z/ Found at https://github.com/Graylog2/graylog2-server/commit/02b8792e6f4b829f0c1d87fcbf2d58b73458b938
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-2q4p-f6gf-mqr5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-27T13:05:23Z/ Found at https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-2q4p-f6gf-mqr5
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-27T13:05:23Z/ Found at https://go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-41044
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.53082
EPSS Score 0.00294
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:28:23.358988+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/41xxx/CVE-2023-41044.json 38.6.0