Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-74031Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers

Medium 6.5

In plain English

A medium-severity path traversal in wazuh-manager from Wazuh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user.

Affected products (as reported)

Vendor	Product	Versions
Wazuh	wazuh-manager	4.1.1 – before 4.14.8

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-w4qc-m4j4-6m9c) vendor-advisory
Wazuh v4.14.8 Release Notes patch, release-notes
VulnCheck Advisory: Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers third-party-advisory