CVE-2026-44024 (fluentd): Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

A critical CVE (CVSS 9.8) has been disclosed in Fluentd affecting the `${tag}` placeholder used in file path construction. Insufficient validation allows attackers to inject path traversal characters (e.g., `../`) when Fluentd receives logs from untrusted sources and uses `${tag}` in file configurations like the `out_file` plugin's `path` parameter. This enables arbitrary file writes with attacker-controlled content, which can be escalated to full Remote Code Execution by overwriting system files, injecting plugins, or modifying configs — all without authentication. The fix is available in Fluentd v1.19.3 or later.