CVE-2026-93347: Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlistfile helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to act as a malicious Wazuh cluster worker and possess the cluster key. The issue is therefore relevant to deployments using clustered Wazuh components where that key has been obtained or a worker is compromised.
What access can an attacker gain?
The attacker can submit DistributedAPI requests containing traversal filenames to read arbitrary files that are readable by Wazuh. This can include client.keys and ossec.conf, which may contain the cluster key.
Which versions need remediation?
Wazuh versions from 4.1.1 up to, but not including, 4.14.8 are affected. Updating to 4.14.8 addresses the vulnerable get_list_file behavior.
How can I determine whether this may already have been exploited?
Review DistributedAPI requests from cluster workers for filename values containing path-traversal sequences and investigate unexpected reads of sensitive Wazuh-readable files. Also treat exposure of client.keys or ossec.conf as potentially exposing the cluster key.