Wazuh High-Severity Path Traversal in Manager Allows Cluster Workers Arbitrary File Writes

Wazuh managers running versions prior to 4.14.8 contain a path traversal vulnerability that permits malicious cluster workers to write files at arbitrary locations on the host system. This issue stems from insufficient validation in the DistributedAPI components responsible for handling file uploads, specifically within the upload_list_file, upload_rule_file, and upload_decoder_file functions.

Root cause

The underlying weakness, classified as CWE-22, arises because the REST controller fails to adequately sanitise filename inputs. When a cluster worker submits a request containing directory traversal sequences such as ../, the system does not block the attempt. This allows the process to escape the intended directory structure and write data to unintended paths on the manager node.

Attack path

Exploitation requires an attacker to hold a valid cluster key, granting them the identity of a cluster worker. With this credential, the attacker sends crafted DistributedAPI requests targeting the file upload endpoints. By embedding ../ sequences in the filename parameter, the request bypasses standard validation checks. The system then processes the request and writes the specified file content to the arbitrary path defined by the traversal sequence, operating under the privileges of the wazuh user.

Affected versions

• Wazuh manager versions 4.1.1 through 4.14.7 are affected.
• Versions 4.14.8 and later are not affected by this specific vulnerability.

Mitigation

• Upgrade Wazuh manager instances to version 4.14.8 or later to apply the vendor fix.
• Rotate cluster keys if there is any suspicion that they have been compromised or exposed.
• Restrict network access to the DistributedAPI ports to only authorised cluster worker IP addresses.
• Monitor file system integrity on manager nodes for unexpected changes in critical directories.

Signals worth monitoring

Security teams should examine audit logs for unusual file creation events originating from the wazuh service account, particularly outside standard configuration directories. Look for DistributedAPI requests containing encoded or literal directory traversal sequences in filename parameters. Alert on any successful file uploads that result in modifications to system binaries or shell profile files. Verify that cluster worker communications originate from expected network segments and monitor for anomalous outbound connections from manager nodes that could indicate command and control activity following a successful write.

What to do and how to stay safe: Wazuh

• Audit current Wazuh manager versions across all environments to identify instances running vulnerable releases.
• Review DistributedAPI access logs for any historical requests containing path traversal patterns from cluster workers.
• Implement strict network segmentation to ensure only trusted cluster workers can reach the manager API endpoints.
• Enable comprehensive file integrity monitoring on manager hosts to detect unauthorized writes once the vendor provides an update.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for this Wazuh vulnerability?

The National Vulnerability Database rates CVE-2026-74043 with a CVSS score of 8.5, which is classified as High severity.

Which specific functions are vulnerable to this path traversal?

The vulnerability exists in the upload_list_file, upload_rule_file, and upload_decoder_file functions within the DistributedAPI.

Does an attacker need external network access to exploit this?

No, the attacker must hold a valid cluster key and act as a cluster worker to send the malicious DistributedAPI requests.