CVE-2026-74043
Received Received - Intake

Path Traversal in Wazuh Agent and Manager

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-74043
EUVD
EUVD-2026-98678

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wazuh wazuh-manager 4.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in Wazuh versions 4.1.1 to 4.14.7. It affects three cluster upload functions: upload_list_file, upload_rule_file, and upload_decoder_file. Attackers with the cluster key can send specially crafted requests with directory traversal sequences like ../ in filenames to bypass validation and write files to arbitrary system locations as the wazuh user.

Detection Guidance

To detect this vulnerability, check Wazuh versions between 4.1.1 and 4.14.7. Verify if cluster workers have access to the cluster key and if DistributedAPI requests contain ../ sequences in filenames. Inspect logs for suspicious file writes outside intended directories by the wazuh user.

Impact Analysis

An attacker could write malicious files anywhere on the system as the wazuh user. This could lead to further exploits like injecting malicious configurations or achieving remote code execution. The impact includes unauthorized file writes, potential system compromise, and data integrity breaches.

Compliance Impact

This vulnerability could lead to unauthorized file writes and potential data breaches, which may violate compliance requirements for data protection and integrity. Organizations using affected Wazuh versions may face non-compliance risks under standards like GDPR and HIPAA due to potential exposure of sensitive data.

Mitigation Strategies

Upgrade Wazuh to version 4.14.8 or later immediately. Ensure cluster keys are secured and restrict access to cluster workers. Monitor file writes by the wazuh user and review API request logs for path traversal attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74043. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart