CVE-2026-48024
Received Received - Intake

Path Traversal in Wazuh Leading to Remote Code Execution

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerge_info() in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled merge_type and name values in a merged synchronization archive. process_files_from_worker() in framework/wazuh/core/cluster/master.py does not adequately confine the resulting path to the declared cluster item directory. A cluster peer holding the shared Fernet key can use traversal in files_metadata.json or a merged-file header to write files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution when Wazuh services reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-48024
EUVD
EUVD-2026-62557

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wazuh wazuh From 4.0.0 (inc) to 4.14.6 (inc)
wazuh wazuh 4.14.6
wazuh wazuh 5.0.0-beta3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48024 is a path traversal vulnerability in Wazuh's cluster synchronization mechanism. It allows an attacker with access to the cluster's shared Fernet key to write arbitrary files anywhere within the WAZUH_PATH directory by exploiting improper path validation in the cluster.unmerge_info function. The vulnerability exists in versions 4.0.0 to 4.14.5 and 5.0.0-beta3.

Detection Guidance

To detect this vulnerability, check Wazuh manager versions between 4.0.0 and 4.14.6 or 5.0.0-beta3. Verify if cluster.unmerge_info() processes peer-controlled merge_type and name values without path sanitization. Inspect logs for suspicious file writes or path traversal attempts in cluster synchronization.

Impact Analysis

An attacker could replace sensitive files like /var/ossec/etc/ossec.conf to configure root-executed commands. This could lead to code execution when Wazuh services reload, potentially compromising the entire Wazuh manager. The attack requires network access to the master's cluster port and the cluster key but no prior worker registration.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized root-level access to Wazuh systems. Attackers could manipulate configuration files like ossec.conf to execute arbitrary commands, potentially exposing or altering sensitive data governed by these regulations. Unauthorized access violates data integrity and confidentiality requirements.

Mitigation Strategies

Upgrade Wazuh to version 4.14.6 or 5.0.0-beta3 or later. Ensure cluster.unmerge_info() validates merge_type and merge_name parameters to prevent path traversal. Restrict write targets to specific sync subdirectories and monitor for unauthorized file writes in WAZUH_PATH.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48024. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart