Executive brief
Wazuh is an open-source threat detection and response platform that monitors file integrity across systems. A local attacker who can create files in monitored directories can inject SQL commands through specially crafted filenames, potentially manipulating which files and integrity checks are reported to security teams. While remote code execution was not confirmed, this could allow an attacker to hide evidence of tampering or exfiltration from security monitoring.
Technical details
The vulnerability is a SQL injection flaw in Wazuh's File Integrity Monitoring (FIM) component, specifically in DB::getFile() and DB::searchFile() functions within src/syscheckd/src/db/src/file.cpp. On non-Windows systems, FIMDBCreator::encodeString() fails to properly escape user-controlled file paths before inserting them into SQLite row filter queries. A local attacker can create a filename containing UNION SELECT expressions; when wazuh-syscheckd processes or deletes this path, the injected SQL is executed. The confirmed impact is manipulation of SELECT result sets consumed by the FIM code. The vulnerability requires local file creation capability in a monitored directory. Patches were released in versions 4.14.6 and 5.0.0-beta3, migrating affected queries to parameterized statements.
Affected products
- Wazuh Wazuh 4.6.0 to 4.14.6 (fixed in 4.14.6), 5.0.0-beta3 and earlier (fixed in 5.0.0-beta3)
Timeline
- 2026-08-19: disclosed
- 2026-05-25: patched: Fix committed; patches released in versions 4.14.6 and 5.0.0-beta3