CVE-2026-45767 Suricata datasets: save to absolute filename can be bypassed when combined with load command
A malicious rule in Suricata can bypass filename restrictions to overwrite arbitrary files on the system during rule loading.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45767?
CVE-2026-45767 is a medium-severity path traversal vulnerability in Oisf Suricata, published on 10 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess `load`+ `save` rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.
Weakness: CWE-22
Which versions are affected by CVE-2026-45767?
It affects 1 product.
Products include Oisf Suricata.
How do I fix CVE-2026-45767?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-45767 being exploited?
There is no known exploitation of CVE-2026-45767 in the wild and no public exploit code.
Other vulnerabilities in Oisf Suricata
Sources
Also known as DEBIAN-CVE-2026-45767, GHSA-gfxq-gffp-w9rv, UBUNTU-CVE-2026-45767.