# CVE-2026-48024: Wazuh path traversal in cluster synchronization

Source: https://junglewise.ai/threats/cve-2026-48024-wazuh-path-traversal-in-cluster-synchronization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48024 · Severity: critical · CVSS 9.1 · Published 2026-08-19

Wazuh is a security platform that monitors systems and detects threats across enterprise networks. A critical vulnerability in cluster synchronization allows an authenticated peer with access to the shared encryption key to write arbitrary files to the system, including overwriting the main configuration file. An attacker can modify the configuration to execute commands as root when Wazuh services restart, leading to complete system compromise.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-48024 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48024 being exploited in the wild.

**How severe is CVE-2026-48024?** Critical severity, with a CVSS score of 9.1, published 19 August 2026.

**Which products and versions are affected?** Wazuh 4.0.0 until 4.14.6, 5.0.0-beta3.

**Is there a fix for CVE-2026-48024?** A patch was published on 2026-05-20: Fixed in versions 4.14.6 and 5.0.0-beta3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48024 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-48024?** Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in the cluster.unmerge_info() function (framework/wazuh/core/cluster/cluster.py) and process_files_from_worker() (framework/wazuh/core/cluster/master.py). These functions construct file paths from merge_type and name values provided by cluster peers in synchronized archives without proper validation. An attacker with the shared Fernet encryption key can craft malicious merge-file headers or files_metadata.json entries containing directory traversal sequences (e.g., ../../../) to write files outside the intended cluster directory. This allows writing to arbitrary locations such as /var/ossec/etc/ossec.conf, which is executed with root privileges when Wazuh reloads, enabling remote code execution. The fix validates merge file parameters to constrain paths to the declared cluster item directory.

## Affected products

- Wazuh Wazuh 4.0.0 until 4.14.6, 5.0.0-beta3

## Timeline

- 2026-08-19: disclosed
- 2026-05-20: patched: Fixed in versions 4.14.6 and 5.0.0-beta3

## References

- [https://github.com/wazuh/wazuh/commit/88fc89fdfb1bf37b9d826e9c281a3d22655733de](https://github.com/wazuh/wazuh/commit/88fc89fdfb1bf37b9d826e9c281a3d22655733de)
- [https://github.com/wazuh/wazuh/pull/36204](https://github.com/wazuh/wazuh/pull/36204)

## Related threats

- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh stack exhaustion in XML parser via element attributes](https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config)
- [Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync)