CVE-2026-74043

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...

CVE-2026-74043

Wazuh versions 4.1.1 before 4.14.8 are vulnerable to a path traversal vulnerability within the upload_list_file, upload_rule_file, and upload_decoder_file functions. This flaw allows malicious cluster workers who possess the cluster key to bypass REST controller validation by sending DistributedA...