Vulnerability · Published Apr 29, 2026 · Assigned by GitHub_M

CVE-2026-30893Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer

Critical 9.0

In plain English

A critical-severity path traversal in wazuh from wazuh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)0.4%top 65.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components (proof of concept available as separate attachment). In deployments where the cluster daemon runs with elevated privileges, system-level compromise is possible. This issue has been patched in version 4.14.4.

Affected products (as reported)

Vendor	Product	Versions
wazuh	wazuh	>= 4.4.0, < 4.14.4

Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-m8rw-v4f6-8787 x_refsource_CONFIRM
https://github.com/wazuh/wazuh/releases/tag/v4.14.4 x_refsource_MISC