Is Logstash 8.18.0 affected?

CVSS 8.1

1 known vulnerability affects 8.18.0 (highest CVSS 8.1).

Your branch 8.18 has reached end of life (Oct 21, 2025).

33 newer releases in its track, up to 8.19.24. What changed up to 8.19.24

A newer release line is out: 9.5.6.

Vulnerabilities affecting 8.18.0

8.1
CVE-2026-33466 Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The… fixed in 8.19.14