CVE-2026-93347
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 13, 2026
- Updated
- Oct 26, 2026
- Reserved
- Sep 17, 2026
Description
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
wazuh-managerWazuh |
|
References
- GitHub Security Advisory (GHSA-xrjw-cqrv-j92g)vendor-advisory
- Wazuh v4.14.8 Release Notespatchrelease-notes
- VulnCheck Advisory: Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_filethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.