CVE-2026-46343
Received Received - Intake

Path Traversal in Wazuh Framework

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH_PATH. A syn_i_w_m_e request with an unknown task_id reaches the cleanup branch, where an attacker-controlled filename is passed to os.path.join without canonicalization or confinement. Absolute paths and traversal sequences can therefore target files such as ossec.conf, jwt_secret.json, TLS certificates, and ruleset files that are accessible to the Wazuh manager process. Deletion can disable the manager, invalidate API tokens, or disrupt cluster and API connectivity. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-46343
EUVD
EUVD-2026-62553

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wazuh wazuh 4.0.0
wazuh wazuh 4.14.6
wazuh wazuh 5.0.0-beta2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46343 is a vulnerability in Wazuh versions 4.0.0 to 4.14.5 and 5.0.0-beta2 where a cluster-authenticated node can delete files outside the WAZUH_PATH. The issue occurs in the end_receiving_file() function due to improper path validation, allowing attackers to use absolute paths or traversal sequences to target critical files like ossec.conf, jwt_secret.json, TLS certificates, and ruleset files. This can disable the manager, invalidate API tokens, or disrupt cluster and API connectivity.

Detection Guidance

To detect this vulnerability, monitor Wazuh cluster logs for suspicious file deletion attempts or errors in the end_receiving_file function. Check for failed file operations or path validation errors in logs like /var/ossec/logs/cluster.log. Ensure Wazuh versions are updated to 4.14.6 or 5.0.0-beta2 or later.

Impact Analysis

This vulnerability allows an attacker with cluster authentication to delete critical files, potentially crashing the Wazuh manager, invalidating API tokens, or disrupting cluster and API connectivity. It could also lead to denial of service or further escalation if sensitive files like SSL certificates or configuration files are deleted.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized file deletion. Deletion of critical files like ossec.conf, jwt_secret.json, or TLS certificates could disrupt security controls, violate data integrity requirements, or expose sensitive data. GDPR requires maintaining data integrity and security, while HIPAA mandates protection of health information. Exploitation could lead to unauthorized access or loss of audit logs, potentially violating these standards.

Mitigation Strategies

Upgrade Wazuh to version 4.14.6 or 5.0.0-beta2 or later to apply the path validation fix in end_receiving_file(). Ensure cluster-authenticated nodes cannot access the Wazuh manager process files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46343. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart