# CVE-2026-49441: Wazuh path traversal in cluster file processing

Source: https://junglewise.ai/threats/cve-2026-49441-wazuh-path-traversal-in-cluster-file-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-49441 · Severity: critical · CVSS 9.1 · Published 2026-08-19

Wazuh is a threat detection and response platform used to monitor and secure enterprise infrastructure. A path traversal vulnerability in its cluster synchronization mechanism allows an authenticated peer with the shared encryption key to upload malicious files that overwrite critical configuration files, potentially enabling root-level code execution when the service is reloaded.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-49441 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49441 being exploited in the wild.

**How severe is CVE-2026-49441?** Critical severity, with a CVSS score of 9.1, published 19 August 2026.

**Which products and versions are affected?** Wazuh 4.3.0 through 4.14.5, 5.0.0-beta2.

**Is there a fix for CVE-2026-49441?** A patch was published on 2026-05-26: Fix merged in version 4.14.6 and 5.0.0-beta3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49441 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-49441?** Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in process_files_from_worker() within framework/wazuh/core/cluster/master.py, where the function fails to validate that the file_path parameter from files_metadata.json remains within the expected directory boundaries. An attacker who possesses the shared Fernet cluster key can craft an archive containing path traversal sequences (e.g., "../../") to write files outside the intended cluster_item_key directory. By targeting security-sensitive files like /var/ossec/etc/ossec.conf, an attacker can inject malicious commands that execute with root privileges after a service reload. The attack requires network access to the cluster and possession of the shared Fernet key. The vulnerability affects Wazuh versions 4.3.0 through 4.14.5 and 5.0.0-beta2, with fixes applied in 4.14.6 and 5.0.0-beta3.

## Affected products

- Wazuh Wazuh 4.3.0 through 4.14.5, 5.0.0-beta2

## Timeline

- 2026-08-19: disclosed
- 2026-05-26: patched: Fix merged in version 4.14.6 and 5.0.0-beta3

## References

- [https://github.com/wazuh/wazuh/commit/7f13682cf5f01f69452f723a608ab2d89cfb2133](https://github.com/wazuh/wazuh/commit/7f13682cf5f01f69452f723a608ab2d89cfb2133)
- [https://github.com/wazuh/wazuh/pull/36296](https://github.com/wazuh/wazuh/pull/36296)

## Related threats

- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh stack exhaustion in XML parser via element attributes](https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config)
- [Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync)