Hi,

The following vulnerability was published for rsyslog.

CVE-2026-92709[0].
| DynFile Path Traversal → Arbitrary File Write as Root → RCE

Right now filling this more as cross-reference to the upstream
tracking.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-92709
https://www.cve.org/CVERecord?id=CVE-2026-92709
[1] https://github.com/rsyslog/rsyslog/security/advisories/GHSA-xmp9-244p-5ggv

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore