CVE-2026-48162
Received Received - Intake

Path Traversal in Wazuh Framework

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make the master return any readable file over the cluster channel. Reading /var/ossec/api/configuration/security/private_key.pem allows the peer to forge administrator REST API tokens offline and then exercise administrative privileges without creating an account. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-48162
EUVD
EUVD-2026-62556

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
wazuh wazuh to 4.14.6 (inc)
wazuh wazuh 5.0.0-beta3
wazuh wazuh 4.0.0
wazuh wazuh 4.14.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Wazuh, a threat detection and response platform. It allows a cluster peer with the shared Fernet key to exploit a path injection flaw in the Distributed API (DAPI) by sending a crafted tmp_file path. This bypasses temporary directory restrictions and enables reading arbitrary files on the master node, such as the REST API's private key. The attacker can then forge administrator JWT tokens offline without creating accounts or leaving audit traces.

Detection Guidance

To detect this vulnerability, check Wazuh manager versions between 4.0.0 and 4.14.5 or 5.0.0-beta3. Run: wazuh-control -V to verify version. Inspect cluster logs for suspicious DAPI requests with crafted tmp_file paths. Look for unauthorized file reads in /var/ossec/logs/cluster.log or /var/ossec/logs/api.log.

Impact Analysis

If you use Wazuh versions between 4.0.0 and 4.14.6 or 5.0.0-beta3, an attacker with network access to the cluster port and the Fernet key could read sensitive files like private keys. This could lead to unauthorized administrative access to the REST API, allowing persistent control over the system without detection.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Unauthorized administrative access may result in data breaches, non-compliance with data protection regulations, and potential legal penalties due to compromised security controls.

Mitigation Strategies

Upgrade Wazuh to version 4.14.6 or later immediately. If upgrading is not possible, restrict network access to the cluster port and rotate the Fernet key. Monitor for unauthorized API token usage and revoke any suspicious tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart