CVE-2026-93347

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlistfile helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read...

CVE-2026-93347

Wazuh versions 4.1.1 before 4.14.8 are vulnerable to a path traversal vulnerability in the get_list_file helper. This flaw occurs because the system fails to validate filename values, allowing malicious cluster workers to read arbitrary files. An attacker possessing the cluster key can send Distr...

CVE-2026-93347 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlistfile helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read...

CVE-2026-93347 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlistfile helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read...

EUVD-2026-98678

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...

CVE-2026-74043 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...

EUVD-2026-98671

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlists and deletelistfile CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path,...

CVE-2026-74033 Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlists and deletelistfile CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path,...

CVE-2026-93347: Improper Limitation of a Pathname to a Restricted Directory

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlistfile helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read...