CVE-2026-48024

creationtimestamp| type| source ---|---|--- 2026-08-19 18:10:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthdczu7tv24 2026-08-19 21:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthpli2ame2m 2026-08-21 16:45:05+00:00| seen|...

CVE-2026-48024 Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmergeinfo in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled mergetype and name values in a merged synchronization archive...