Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-74043Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions

Critical 9.0

In plain English

A critical-severity path traversal in wazuh-manager from Wazuh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)0.4%top 61.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.

Affected products (as reported)

Vendor	Product	Versions
Wazuh	wazuh-manager	4.1.1 – before 4.14.8

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

References

GitHub Security Advisory (GHSA-cw26-jj8q-x7w5) vendor-advisory
Wazuh v4.14.8 Release Notes patch, release-notes
VulnCheck Advisory: Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions third-party-advisory