Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.9
CVE-2026-74043: Wazuh Manager allows unauthorized file write via upload
CVE-2026-74043 · published 2 days ago
Summary
The Wazuh manager (versions 4.1.1 through 4.14.7) lets anyone with the cluster key send specially crafted upload requests that include ".." in the filename. This lets the attacker place files anywhere on the server, potentially altering or adding malicious code. Disable or restrict cluster key usage and upgrade to version 4.14.8 or later.
What to do
- Update wazuh wazuh-manager to version 4.14.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wazuh | wazuh-manager | < 4.14.8 |
Original advisory text
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.
References
- https://github.com/wazuh/wazuh/security/advisories/GHSA-cw26-jj8q-x7w5 Vendor Advisory
- https://github.com/wazuh/wazuh/releases/tag/v4.14.8 Patch
- https://www.vulncheck.com/advisories/wazuh-4.1.1-before-4.14.8-path-traversal-vi... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74043... Vendor Advisory
- https://github.com/wazuh/wazuh Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-74043 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.9
High
Type
CWE-22Path Traversal
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta