Executive brief
Wazuh is a threat detection and response platform used to monitor and secure enterprise infrastructure. A path traversal vulnerability in its cluster synchronization mechanism allows an authenticated peer with the shared encryption key to upload malicious files that overwrite critical configuration files, potentially enabling root-level code execution when the service is reloaded.
Technical details
The vulnerability exists in process_files_from_worker() within framework/wazuh/core/cluster/master.py, where the function fails to validate that the file_path parameter from files_metadata.json remains within the expected directory boundaries. An attacker who possesses the shared Fernet cluster key can craft an archive containing path traversal sequences (e.g., "../../") to write files outside the intended cluster_item_key directory. By targeting security-sensitive files like /var/ossec/etc/ossec.conf, an attacker can inject malicious commands that execute with root privileges after a service reload. The attack requires network access to the cluster and possession of the shared Fernet key. The vulnerability affects Wazuh versions 4.3.0 through 4.14.5 and 5.0.0-beta2, with fixes applied in 4.14.6 and 5.0.0-beta3.
Affected products
- Wazuh Wazuh 4.3.0 through 4.14.5, 5.0.0-beta2
Timeline
- 2026-08-19: disclosed
- 2026-05-26: patched: Fix merged in version 4.14.6 and 5.0.0-beta3