CVE-2026-49392
Received Received - Intake

SQL Injection in Wazuh File Integrity Monitoring

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems, FIMDBCreator::encodeString() does not escape the value. A local user who can create a filename in a File Integrity Monitoring directory can inject a UNION SELECT expression when wazuh-syscheckd processes or deletes that path. The confirmed primitive manipulates SELECT result sets consumed by the FIM code; stacked statements and remote code execution were not demonstrated. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-49392
EUVD
EUVD-2026-62577

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wazuh wazuh From 4.6.0 (inc) to 4.14.6 (inc)
wazuh wazuh 4.14.6
wazuh wazuh 5.0.0-beta3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-49392 is a local SQL injection vulnerability in Wazuh's File Integrity Monitoring (FIM) database layer. It affects versions from 4.6.0 to 4.14.5 and 5.0.0-beta3. The issue occurs because the system constructs SQL queries by directly concatenating file paths into row filters without proper escaping or parameterization. On non-Windows systems, malicious filenames can inject SQL commands like UNION SELECT into queries processed by wazuh-syscheckd.

Detection Guidance

To detect this vulnerability, check if your Wazuh version is between 4.6.0 and 4.14.5 or 5.0.0-beta3. Look for files with malicious filenames in monitored directories that could trigger SQL injection. Review logs for errors in wazuh-syscheckd processing or database operations.

Impact Analysis

An attacker with local access could create a file with a specially crafted name in a monitored directory. When Wazuh processes or deletes this file, the malicious path could manipulate database queries to return unexpected data, modify FIM event contents, or cause denial of service through expensive queries. The confirmed impact is limited to data manipulation in FIM results; remote code execution was not demonstrated.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation in Wazuh's FIM database, potentially violating integrity and confidentiality requirements in GDPR and HIPAA. GDPR requires protection against unauthorized data access, while HIPAA mandates integrity controls for protected health information. Exploitation could result in non-compliance due to compromised audit logs or monitoring data.

Mitigation Strategies

Upgrade Wazuh to version 4.14.6 or 5.0.0-beta3 or later. Ensure no untrusted files exist in monitored directories. Monitor wazuh-syscheckd logs for suspicious activity. Apply patches from the official Wazuh repository to prevent SQL injection via path manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49392. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart