{"id":"CVE-2026-74043","published":"2026-10-13T14:17:41.003","lastModified":"2026-10-13T20:39:48.767","description":"Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.8","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-cw26-jj8q-x7w5","tags":[]},{"url":"https://www.vulncheck.com/advisories/wazuh-4.1.1-before-4.14.8-path-traversal-via-cluster-upload-functions","tags":[]}],"exploitRefs":[{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.8","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-cw26-jj8q-x7w5","tags":[]}],"hasPoc":true,"ai":{"summary":"A path traversal vulnerability in Wazuh's cluster file upload functions allows malicious cluster workers to write files anywhere on the filesystem as the wazuh user, potentially leading to arbitrary code execution or data compromise.","exploitability":"Moderately difficult to exploit as it requires an attacker to already possess the cluster key and have access to a cluster worker node, but once achieved, allows for arbitrary file writes with high privileges.","blast_radius":"The vulnerability could impact all Wazuh cluster nodes that allow file uploads, potentially leading to full cluster compromise, data exfiltration, or persistence mechanisms being established by attackers.","remediation":"Upgrade to Wazuh 4.14.8 or later to remediate this path traversal vulnerability in the cluster file upload functions.","detection":"Monitor for unusual file creation patterns in the Wazuh installation directory and its subdirectories, particularly around configuration files and logs, as well as network traffic to the cluster API endpoints related to file uploads.","tags":["path-traversal","cluster","privilege-escalation","file-upload"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:57:36.679Z"}}