Wazuh Manager: Path traversal in cluster upload functions
Summary
Wazuh Manager versions from 4.1.1 before 4.14.8 contain a path traversal flaw in the cluster upload helpers upload_list_file, upload_rule_file and upload_decoder_file. A malicious or compromised cluster worker that holds the cluster key can send crafted requests with ../ sequences in the filename and write files to arbitrary paths as the wazuh service user. The REST API filename validation is bypassed on this cluster path. A public proof of concept is listed by the Italian CSIRT (ACN); exploitation in the wild is unconfirmed.
Affected
- Wazuh wazuh-manager 4.1.1 to before 4.14.8 (CNA record)
- Some sources list narrower or wider ranges (up to 4.14.7, or 4.14.0 to 4.14.8); treat older branches as affected until verified
- Single-node installations without a cluster are not reached via this path
- 5.0.0 beta: unknown
Fixed in
- Wazuh 4.14.8 (released 23 September 2026 according to the vendor release notes)
Workaround
- None documented by the vendor. Upgrading to 4.14.8 or later is the remedy.
Exploitation
- Public proof of concept listed by ACN; not reviewed by us
- No confirmed exploitation in the wild
- EPSS 0.00363 (low near-term probability)
- Attacker needs the cluster key (CVSS 4.0 PR:H)
Our recommendation
- Upgrade all Wazuh manager nodes to 4.14.8 or later, prioritising multi-node clusters
- Treat the cluster key as a high-value secret and rotate it if staff or hosts with access have changed
- Remove unused cluster nodes and restrict access to the cluster port in firewalls
- Review the manager for unexpected files under rules, decoders and list directories
- Confirm the running version rather than assuming it is patched
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-cw26-jj8q-x7w5 github.com
- VulnCheck advisory www.vulncheck.com
- Wazuh release v4.14.8 github.com
- ACN: Available PoCs for Wazuh vulnerabilities www.acn.gov.it
- Wazuh 4.14.8 release notes documentation.wazuh.com
- Mend record CVE-2026-74043 vulners.com
- VulDB 417688 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:44.
Original description (NVD)
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.