# CVE-2026-48162: Wazuh path traversal in cluster DAPI send_tmp_file

Source: https://junglewise.ai/threats/cve-2026-48162-wazuh-path-traversal-in-cluster-dapi-send-tmp-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48162 · Severity: critical · CVSS 9.1 · Published 2026-08-19

Wazuh is an open-source security operations platform that monitors and responds to threats across infrastructure. A flaw in its cluster communication protocol allows a peer node holding the shared encryption key to read arbitrary files from the master server, including the private API authentication key. An attacker can abuse this to forge administrator tokens and gain full administrative control over the platform without creating a user account.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-48162 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48162 being exploited in the wild.

**How severe is CVE-2026-48162?** Critical severity, with a CVSS score of 9.1, published 19 August 2026.

**Which products and versions are affected?** Wazuh 4.0.0 to 4.14.5, 5.0.0-beta2.

**Is there a fix for CVE-2026-48162?** A patch was published on 2026-05-21: Fixed in versions 4.14.6 and 5.0.0-beta3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48162 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-48162?** Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in the DistributedAPI.send_tmp_file() method (framework/wazuh/core/cluster/dapi/dapi.py). The method fails to canonicalize or confine an attacker-controlled tmp_file parameter before joining it to WAZUH_PATH, allowing traversal sequences (../) or absolute paths to escape the intended directory. An authenticated cluster peer (one holding the shared Fernet key) can exploit this to read any file accessible to the Wazuh process, notably /var/ossec/api/configuration/security/private_key.pem. With the private key, an attacker can cryptographically forge REST API authentication tokens for administrator accounts offline, bypassing account creation and authentication mechanisms. The fix adds realpath() canonicalization and validates that resolved paths remain within OSSEC_TMP_PATH. Affected versions: 4.0.0–4.14.5 and 5.0.0-beta2; patched in 4.14.6 and 5.0.0-beta3.

## Affected products

- Wazuh Wazuh 4.0.0 to 4.14.5, 5.0.0-beta2

## Timeline

- 2026-08-19: disclosed
- 2026-05-21: patched: Fixed in versions 4.14.6 and 5.0.0-beta3

## References

- [https://github.com/wazuh/wazuh/commit/de1eeedbe336744934be4e20d87d84a76e438cee](https://github.com/wazuh/wazuh/commit/de1eeedbe336744934be4e20d87d84a76e438cee)
- [https://github.com/wazuh/wazuh/pull/36246](https://github.com/wazuh/wazuh/pull/36246)

## Related threats

- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh stack exhaustion in XML parser via element attributes](https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config)
- [Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync)