Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-93347Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
Medium 4.9
In plain English
A medium-severity path traversal in wazuh-manager from Wazuh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.4%top 63.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wazuh | wazuh-manager | 4.1.1 – before 4.14.8 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-xrjw-cqrv-j92g) vendor-advisory
- Wazuh v4.14.8 Release Notes patch, release-notes
- VulnCheck Advisory: Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file third-party-advisory