CVE-2026-49392: Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems, FIMDBCreator::encodeString() does not escape the value. A local user who can create a filename in a File Integrity Monitoring directory can inject a UNION SELECT expression when wazuh-syscheckd processes or deletes that path. The confirmed primitive manipulates SELECT result sets consumed by the FIM code; stacked statements and remote code execution were not demonstrated. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wazuh-syscheckd (FIM syscheckd database path lookup interpolation in src/syscheckd/src/db/src/file.cpp)to a version that resolves this vulnerability.Fixed in 4.14.6 - Upgrade
Upgrade
wazuh-syscheckd (FIM syscheckd database path lookup interpolation in src/syscheckd/src/db/src/file.cpp)to a version that resolves this vulnerability.Fixed in 5.0.0-beta3
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Non-Windows Wazuh deployments are affected when File Integrity Monitoring includes a directory where a local user can create filenames. The affected versions are 4.6.0 through 4.14.6 and 5.0.0-beta3.
What access does an attacker need to exploit it?
An attacker needs local access and the ability to create a specially crafted filename in a monitored FIM directory. Exploitation occurs when wazuh-syscheckd processes or deletes that path.
Are all Wazuh installations affected by default?
The issue requires a monitored FIM directory that is writable by a local user. The provided information does not establish whether such a directory is present in the default configuration.
What is the impact if exploitation succeeds?
The demonstrated technique injects a UNION SELECT expression and manipulates SQLite SELECT results consumed by FIM code. Stacked SQL statements and remote code execution were not demonstrated.
What should be done if an immediate upgrade is not possible?
Restrict local users from creating filenames in directories monitored by FIM, particularly on non-Windows systems. This removes the stated prerequisite for exploitation.