CVE-2026-74043: Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must hold the Wazuh cluster key and be able to send DistributedAPI requests as a malicious cluster worker. The issue is not described as exploitable by an unauthenticated external user.
Which deployments are affected?
Wazuh versions from 4.1.1 up to, but not including, 4.14.8 are affected. Deployments using the cluster upload functions upload_list_file, upload_rule_file, or upload_decoder_file are exposed to the vulnerable request handling.
What access does successful exploitation provide?
A malicious worker can use ../ sequences in a filename to bypass REST controller validation and write files to arbitrary paths accessible to the wazuh user. The impact includes high integrity and availability impact, with limited confidentiality impact.
What can be done if upgrading is not immediately possible?
Protect the cluster key from unauthorized disclosure and restrict who can operate or join cluster workers and send DistributedAPI requests. Treat compromise of the cluster key as a condition requiring investigation because it enables the described attack path.
How can I determine whether I am affected?
Check the installed Wazuh version and whether cluster workers can use the affected upload functions. Versions earlier than 4.14.8 and at least 4.1.1 should be considered affected.