CVE-2026-74031: Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the deleterulefile and deletedecoderfile helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh installations running versions from 4.1.1 before 4.14.8 are affected. Exploitation targets the cluster worker functionality through DistributedAPI.
What level of access does an attacker need?
An attacker needs the Wazuh cluster key, allowing them to act as a malicious cluster worker and invoke the vulnerable delete helpers. No user interaction is required.
What can an attacker delete?
Traversal sequences in the unvalidated filename parameter can cause deletion of arbitrary files accessible to the wazuh user. Examples identified include ossec.conf, client.keys, and rule files.
What version fixes the vulnerability?
Wazuh 4.14.8 addresses the issue. Systems running an earlier affected release should be upgraded to 4.14.8 or later.