Add upgrade guidance for file audit device security changes (CVE-2025-6000)

Added details to upgrade and important changes docs for Vault versions 1.16.x, 1.18.x, 1.19.x, and 1.20.x about new requirements for file audit devices: explicit configuration for prefixing, restrictions on writing to plugin directories, and prohibition of executable file permissions. Recommendations for configuration updates are provided.

Fixes introduced in hashicorp/vault#31211 for CVE-2025-6000.

Author: pixambi

content/vault/v1.16.x/content/docs/upgrading/upgrade-to-1.16.x.mdx

@@ -233,6 +233,20 @@ reports if manual reporting is preferred.
 See the main page for [Vault product usage metrics reporting](/vault/docs/enterprise/license/product-usage-reporting) for
 more details, and information about opt-out.
 
+### File audit devices require explicit configuration for prefixing, cannot write to plugin directory, and cannot use executable file permissions ((#audit-file-security))
+
+| Change       | Affected version                          | Fixed version
+| ------------ | ----------------------------------------- | --------------------
+| Breaking     | 1.16.23                                   | N/A
+
+File audit devices with the `prefix` option will fail to enable unless `allow_audit_log_prefixing = true` is set in the server configuration. Additionally, file audit devices cannot write to the plugin directory or any subdirectory within it, and cannot use file modes with executable permissions (e.g., 0777, 0755).
+
+#### Recommendation
+
+- If you use the `prefix` option with file audit devices, add `allow_audit_log_prefixing = true` to your Vault server configuration. 
+- Ensure audit log file paths are not within the plugin directory.
+- Use non-executable file modes (e.g., 0644, 0666).
+
 ## Known issues and workarounds
 
 

content/vault/v1.18.x/content/docs/upgrading/upgrade-to-1.18.x.mdx

@@ -184,6 +184,20 @@ reports if manual reporting is preferred.
 See the main page for [Vault product usage metrics reporting](/vault/docs/enterprise/license/product-usage-reporting) for
 more details, and information about opt-out.
 
+### File audit devices require explicit configuration for prefixing, cannot write to plugin directory, and cannot use executable file permissions ((#audit-file-security))
+
+| Change       | Affected version                          | Fixed version
+| ------------ | ----------------------------------------- | --------------------
+| Breaking     | 1.18.12                                   | N/A
+
+File audit devices with the `prefix` option will fail to enable unless `allow_audit_log_prefixing = true` is set in the server configuration. Additionally, file audit devices cannot write to the plugin directory or any subdirectory within it, and cannot use file modes with executable permissions (e.g., 0777, 0755).
+
+#### Recommendation
+
+- If you use the `prefix` option with file audit devices, add `allow_audit_log_prefixing = true` to your Vault server configuration. 
+- Ensure audit log file paths are not within the plugin directory.
+- Use non-executable file modes (e.g., 0644, 0666).
+
 ## Known issues and workarounds
 
 @include 'known-issues/duplicate-hsm-key.mdx'

content/vault/v1.19.x/content/docs/updates/important-changes.mdx

@@ -119,8 +119,19 @@ Review the [Token validation](/vault/docs/auth/azure#token-validation) section
 of the Azure authN plugin guide for more information on the new validation
 requirements.
 
+### File audit devices require explicit configuration for prefixing, cannot write to plugin directory, and cannot use executable file permissions ((#audit-file-security))
 
+| Change       | Affected version                          | Fixed version
+| ------------ | ----------------------------------------- | --------------------
+| Breaking     | 1.19.7                                    | N/A
 
+File audit devices with the `prefix` option will fail to enable unless `allow_audit_log_prefixing = true` is set in the server configuration. Additionally, file audit devices cannot write to the plugin directory or any subdirectory within it, and cannot use file modes with executable permissions (e.g., 0777, 0755).
+
+#### Recommendation
+
+- If you use the `prefix` option with file audit devices, add `allow_audit_log_prefixing = true` to your Vault server configuration. 
+- Ensure audit log file paths are not within the plugin directory.
+- Use non-executable file modes (e.g., 0644, 0666).
 
 ## Breaking changes
 

content/vault/v1.20.x/content/docs/updates/important-changes.mdx

@@ -42,6 +42,20 @@ Vault currently does not support rotate root for key pairs. To manually rotate k
 For more information on rotating key pairs, please refer
 to the official [Snowflake documentation](https://docs.snowflake.com/en/user-guide/key-pair-auth#configuring-key-pair-rotation).
 
+### File audit devices require explicit configuration for prefixing, cannot write to plugin directory, and cannot use executable file permissions ((#audit-file-security))
+
+| Change       | Affected version                          | Fixed version
+| ------------ | ----------------------------------------- | --------------------
+| Breaking     | 1.20.1                                    | N/A
+
+File audit devices with the `prefix` option will fail to enable unless `allow_audit_log_prefixing = true` is set in the server configuration. Additionally, file audit devices cannot write to the plugin directory or any subdirectory within it, and cannot use file modes with executable permissions (e.g., 0777, 0755).
+
+#### Recommendation
+
+- If you use the `prefix` option with file audit devices, add `allow_audit_log_prefixing = true` to your Vault server configuration. 
+- Ensure audit log file paths are not within the plugin directory.
+- Use non-executable file modes (e.g., 0644, 0666).
+
 ## Breaking changes
 
 ### Breaking configuration change for disable_mlock ((#disable_mlock-config))