CVE-2026-46343: Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.endreceivingfile() in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUHPATH. A syniwme request with an unknown taskid reaches the cleanup branch, where an attacker-controlled filename is passed to os.path.join without canonicalization or confinement. Absolute paths and traversal sequences can therefore target files such as ossec.conf, jwtsecret.json, TLS certificates, and ruleset files that are accessible to the Wazuh manager process. Deletion can disable the manager, invalidate API tokens, or disrupt cluster and API connectivity. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuh (framework/wazuh/core/cluster/common.py)to a version that resolves this vulnerability.Fixed in 4.14.6 - Upgrade
Upgrade
Wazuh (framework/wazuh/core/cluster/common.py)to a version that resolves this vulnerability.Fixed in 5.0.0-beta2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh versions from 4.0.0 through 4.14.6, and 5.0.0-beta2, are identified as affected. Exploitation targets files accessible to the Wazuh manager process.
What access does an attacker need to exploit it?
The attacker needs to operate a cluster-authenticated node and send a syn_i_w_m_e request using an unknown task_id. The vulnerable cleanup path then uses the attacker-controlled filename without canonicalization or confinement to WAZUH_PATH.
What is the practical impact of successful exploitation?
An attacker can delete accessible files outside WAZUH_PATH using absolute paths or traversal sequences. Potential targets include ossec.conf, jwt_secret.json, TLS certificates, and ruleset files, which can disable the manager or disrupt API and cluster connectivity.
What versions contain the fix?
The issue is fixed in Wazuh 4.14.6 and 5.0.0-beta2.